CVE-2021-29279

Name	CVE-2021-29279
Description	There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1. In which, the arg const GF_PropertyValue *value,maybe value->value.data.size is a negative number. In result, memcpy in gf_props_assign_value failed.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	987323

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gpac (PTS)	bullseye (security), bullseye	1.0.1+dfsg1-4+deb11u3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
gpac	source	stretch	(not affected)
gpac	source	buster	(not affected)
gpac	source	(unstable)	1.0.1+dfsg1-4	987323

Notes

[buster] - gpac <not-affected> (Vulnerable code not present)
[stretch] - gpac <not-affected> (Vulnerable code not present)
https://github.com/gpac/gpac/commit/da69ad1f970a7e17c865eaec9af98cc84df10d5b
https://github.com/gpac/gpac/issues/1718