Security advisory

{
  "id": "2e36de016713cf2715a7c45dda016799aa805b6f3736d7c3324b5378b03f470d",
  "url": "https://osv.dev/vulnerability/CVE-2021-29279",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-29279",
    "summary": "There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1. In which, the arg const GF_PropertyValue *value,maybe value->value.data.size is a negative number. In result, memcpy in gf_props_assign_value failed.",
    "evidence": "osv:CVE-2021-29279",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2021-29279",
      "aliases": [
        "CVE-2021-29279"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/gpac/gpac",
              "type": "GIT",
              "events": [
                {
                  "introduced": "d8538e8ae946b32d99c6b2c57cbb327146e9cd9d"
                },
                {
                  "last_affected": "d8538e8ae946b32d99c6b2c57cbb327146e9cd9d"
                },
                {
                  "fixed": "da69ad1f970a7e17c865eaec9af98cc84df10d5b"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:gpac:gpac:1.0.1:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "1.0.1"
                      },
                      {
                        "last_affected": "1.0.1"
                      }
                    ],
                    "source": "CPE_STRING"
                  },
                  {
                    "range": [
                      {
                        "fixed": "da69ad1f970a7e17c865eaec9af98cc84df10d5b"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "1.0.1",
            "v1.0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-29279.json",
            "vanir_signatures": [
              {
                "id": "CVE-2021-29279-688a941d",
                "digest": {
                  "length": 4986,
                  "function_hash": "271809893264534884931660195218224896488"
                },
                "source": "https://github.com/gpac/gpac/commit/da69ad1f970a7e17c865eaec9af98cc84df10d5b",
                "target": {
                  "file": "src/filters/reframe_flac.c",
                  "function": "flac_dmx_process"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              },
              {
                "id": "CVE-2021-29279-8515935a",
                "digest": {
                  "threshold": 0.9,
                  "line_hashes": [
                    "102029437854238077049081131219035328767",
                    "1758822345310994078902333647147355295",
                    "91375987480369385241196899295650106496",
                    "164621250167976074906983121855801251933",
                    "173713928589759872021528131545224180852",
                    "120156287496062208041479094701390957082",
                    "134773658905465572514737648898400473062",
                    "67876114723218513615781741177926374455",
                    "211218421710624493902262592900065165246",
                    "171764359295326514391450423514496630009",
                    "231355731579607298891416484118488240950",
                    "152456470730324089017527564619705188047",
                    "225970606774595338019741053708735811980",
                    "59026396062773415428220475118579893939"
                  ]
                },
                "source": "https://github.com/gpac/gpac/commit/da69ad1f970a7e17c865eaec9af98cc84df10d5b",
                "target": {
                  "file": "src/filters/reframe_flac.c"
                },
                "deprecated": false,
                "signature_type": "Line",
                "signature_version": "v1"
              }
            ],
            "vanir_signatures_modified": "2026-10-20T14:20:30Z"
          }
        }
      ],
      "modified": "2026-10-20T14:20:30.598811329Z",
      "provider": "osv",
      "references": [
        "https://github.com/gpac/gpac/commit/da69ad1f970a7e17c865eaec9af98cc84df10d5b",
        "https://github.com/gpac/gpac/issues/1718"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-29279",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 388811,
  "published_at": "2021-04-19T20:15:14.287+00:00"
}