CVE-2022-47091: 
NixOS vulnerability analysis and mitigation

GPAC MP4box 2.1-DEV-rev574-g9d5bb184b was found to contain a buffer overflow vulnerability in the gf_text_process_sub function located in filters/load_text.c. The vulnerability was discovered and reported on December 11, 2022 (GitHub Issue).

The vulnerability occurs in the gf_text_process_sub function where a buffer overflow can be triggered during text processing. The issue specifically manifests in a loop condition where array bounds are not properly checked: 'while (szLine[i+1+j] && szLine[i+1+j]!='}') { szTime[i] = szLine[i+1+j]; i++; }'. This leads to an out-of-bounds write when the index exceeds the buffer size of the szTime array (GitHub Issue).

The buffer overflow vulnerability could potentially lead to denial of service (DoS) conditions or remote code execution (RCE) when processing maliciously crafted input files (GitHub Issue).

The vulnerability has been addressed in subsequent releases. Debian has released security updates to fix this issue in version 1.0.1+dfsg1-4+deb11u2 for the stable distribution (bullseye). Users are recommended to upgrade their gpac packages to the latest version (Debian Security).