GPAC MP4box v2.0.0 was discovered to contain a stack overflow in the smilparsetimelist parameter at /scenegraph/svgattributes.c.

GPAC 2.0.0 misuses a certain Unicode utf8wcslen (renamed gfutf8wcslen) function in utils/utf.c, resulting in a heap-based buffer over-read, as demonstrated by MP4Box.

gprtpbuilderdohevc in ietf/rtppckmpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box.

NULL Pointer Dereference in GitHub repository gpac/gpac prior to v2.1.0-DEV.

Use After Free in GitHub repository gpac/gpac prior to 2.1-DEV.

Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.1-DEV.

MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function diSTboxread() to read from video. In this function, it allocates a buffer str with fixed length. However, content read from bs is controllable by user, so is the length, which causes a buffer overflow.

Null Pointer Dereference Caused Segmentation Fault in GitHub repository gpac/gpac prior to 2.1.0-DEV.