CVE-2021-30019

Name	CVE-2021-30019
Description	In the adts_dmx_process function in filters/reframe_adts.c in GPAC 1.0.1, a crafted file may cause ctx->hdr.frame_size to be smaller than ctx->hdr.hdr_size, resulting in size to be a negative number and a heap overflow in the memcpy.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	987323

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gpac (PTS)	bullseye (security), bullseye	1.0.1+dfsg1-4+deb11u3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
gpac	source	stretch	(not affected)
gpac	source	buster	(not affected)
gpac	source	(unstable)	1.0.1+dfsg1-4	987323

Notes

[buster] - gpac <not-affected> (Vulnerable code not present)
[stretch] - gpac <not-affected> (Vulnerable code not present)
https://github.com/gpac/gpac/commit/22774aa9e62f586319c8f107f5bae950fed900bc
https://github.com/gpac/gpac/issues/1723