{"id":"CVE-2019-15148","details":"GoPro GPMF-parser 1.2.2 has an out-of-bounds write in OpenMP4Source in demo/GPMF_mp4reader.c.","modified":"2026-03-14T01:43:56.561525Z","published":"2019-08-18T19:15:10.620Z","references":[{"type":"FIX","url":"https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681"},{"type":"FIX","url":"https://github.com/gopro/gpmf-parser/issues/60"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gopro/gpmf-parser","events":[{"introduced":"0"},{"last_affected":"27d1a97ef8dec50241e5ee3d45175a7fd2090286"},{"fixed":"341f12cd5b97ab419e53853ca00176457c9f1681"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"1.2.2"}]}}],"versions":["V1.2.2","v1.0","v1.01","v1.1","v1.1.1","v1.1.2","v1.2","v1.2.1","v1.2.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15148.json","vanir_signatures":[{"signature_version":"v1","target":{"file":"demo/GPMF_demo.c"},"source":"https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681","signature_type":"Line","id":"CVE-2019-15148-01934b05","digest":{"threshold":0.9,"line_hashes":["200681822250511692534496730709982901018","59614317341743251993177109435529733326","320949205414937743911665994726594073767","6448448985185353001986333300894904350","273613998404041135664323500634566017172","90155686732936723078315435319068003526","258398613753555468106272085217925118592","263592105890563442887723080113111971459","336351924091919125141994841317499839466","179306620313929763789599673720086116656","316773586751940553487162705054920558262","188875449766003649949740637322838216121","70717963177803728003376212290856694697","94621856486663495325775398469416790545","181228234581618344825125373478805899115"]},"deprecated":false},{"signature_version":"v1","target":{"file":"GPMF_parser.c"},"source":"https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681","signature_type":"Line","id":"CVE-2019-15148-0b1766b6","digest":{"threshold":0.9,"line_hashes":["230713506187316847744847646714610214635","37494836913369941704313066646871096652","187176805628257311425951364779265682106","74821365492791011835911433974107069365","192975502579589833833813741139622777046"]},"deprecated":false},{"signature_version":"v1","target":{"file":"demo/GPMF_mp4reader.c","function":"OpenMP4Source"},"source":"https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681","signature_type":"Function","id":"CVE-2019-15148-0e1d44ef","digest":{"function_hash":"267244365540618502442308719997636727797","length":11276},"deprecated":false},{"signature_version":"v1","target":{"file":"demo/GPMF_mp4reader.h"},"source":"https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681","signature_type":"Line","id":"CVE-2019-15148-1c59fe45","digest":{"threshold":0.9,"line_hashes":["8532340338242775206288580339933539948","331100407068089782019494557517375711993","94659598565063723599584173750537514708","192471026562038029818172395709253002869","294066603739727459943442729211622662913","230483605745842056525071143326187723234","3811950352555591441502707134222623385","201624057050509251865041581732312158703","246017935822001371897488678987274955342","301030285780022915047127302052464790525","92033864571663137543580303484580943029","321773962255249042974435333271687973436","333876255770721149418569307468299685703"]},"deprecated":false},{"signature_version":"v1","target":{"file":"demo/GPMF_mp4reader.c"},"source":"https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681","signature_type":"Line","id":"CVE-2019-15148-51d3390c","digest":{"threshold":0.9,"line_hashes":["230713506187316847744847646714610214635","240495145393664620008872572662832536486","149870090503505968407672716011732588778","299794084501193658249800509020445234776","82955875710980257204307917079449540974","97509363632926153083662383955924315421","112430528332282783998254584164377784706","175811316987281283178502822542794588715","108935370571815804901706190124992397717","303210095982849627097176926979231526423","243648434798709100713339855785474133858","51374025467099187589268095526235070549","241696835884668935181699524569290465196","56939446664885775172680369188543260886","231342920356893746352251833927844285898","274865286063229409166983258553711854656","220884027888050459794073188008898298494","282321365938335972494557316893583148400","54679467037083301701022699328145360341","235114990239514809439166147329784185352","309199795585346488662875341012804905654","338476290630820205867425168630351597823","279128262020197896351087090683153895026","78567781343864308860148696450447413991","59797301265689595284450285537157510552","158998499909852909222020032794826179505","59713060948658147553992152780718835205","31937598450931303065092256174186772323","157290447299786758788072455602417539640","28403537812160016744295771499858215901","80235869242518218141039917119323695270","278013329293128038026238858834376886788","315280796365304304204994307636157481423","212977513325741983416288330289699707971","20256415443661500633220083819519769733","80987582309760972270130147758634452860","121395480226308988775161628892883394178","203736534135873727211683874423992642254","91845360027457352844609072440276731517","108437415661380853158981659841391909630","17752505043323161399362960705738677314","257173276617307252288345981856019055062","155987702078566784035916912684271178981","49031435868125681978498662549677533318","215602082640355307672550090850210057521","296007854355334157319076103234275542614","106825421702351205421517708799573772802","208647104446268947621014149251038604196","68742213899975273094962316367695725229","218311635987838986022161420713304924521","274323677614971134955210207442306510360","334339592745325174508163478771304204378","117729890011397108062716152203287015269","208824389221514342392051271508553496584","259124443723249086209401290815224711970","244594965827453179172097036751955437749","121411168673604242414944004049838259281","61084152606142244029906787048944119262","138065911869463579540805094541636130256","172657127803633828684048975541686541904","317540035603135563086250258571186435024","37190810458359940654870479881516855223","165211279080613002212303609479621570640","88526944618847855087798666425610877154","32105072108923497935698532486408079697","74377289954449163210347676549749877166","321672134663149745310492469913594243720","159603371650027104476878343332579522533","269049369060100087742823260601902222961","110095773394712262511452879110397550957","204611159918272242324587318788871824882","228715457607586937167053031126294335694","174075696344970952206082761408554803057","257677143130707431620765171330211887262","88015650290117837915239205457278843596","247296662337622404402464490514003657683","120323281590561433757367602783094379440","67607948256644619567655729281508496315","118734226952722211097635386615475933730","179850831037905309264926355402748235991","175367042825778859508442401993981778633","313012643398934526603930686092403437175","244103119019656126869431658319620406646","183114636651723545294967839383462479627","294298086865885317001127449477012120829","219595633188461084191729469271180438166","128163680410443605068922688516825854951","269858899015258374928738988387316316389","204800135933546650328713181589254437017","102500287572422028087803859781865741054","88375505150979469912701707796271576433","266861521274678061445201486835118955392","166667974505772659338914434986592427049","267638867204172788654749521688829927255","113502100981358425652746919455709999202","213747456608832858324546455723321519005","83706296036557046795536392517057243967","228062381032822508776093406407877630042","22466336969589010578162578214722361405","269416220953451892885712994894610692034","254590165169785193145809882460592517114","181080301713957712617727601054249064630","103191805729037775516262140197080416910","143115331096999491604837129523720282160","287113605328358166336373405662942989465","26794715755485271193960607621725891917","46193972190410093611266825986659572670","232376931199747908277901046390417506985","293731727658722956073941156408743682270","168122537750898261104943656197206396000","77172792733499630260688823401957904751","6459644963461861102632474440986071527","209463064448556826527733680510777174482","218598613553009146520092676045266175542","269858899015258374928738988387316316389","204800135933546650328713181589254437017","102500287572422028087803859781865741054","88375505150979469912701707796271576433","266861521274678061445201486835118955392","306543201051567839742849270497317793126","185615923088265734140323573203861383694","291347906233834095629854455082720604026","150597029010112316236076852237576998183","189619903637604690278402247640608915211","112974489025798146669683931273860989846","262517965258385471550291895448272593053","316654473288405907330116222244060840466","133654885920029869819887461967128848897","268827439441554315260552815842352586613","281384855709992014511600788669514612337","135856375446666375149451452999492565815","145064246120319728746537221441034564088","69539082785433832081026176574091571484","12606192014632242412403173285483282993","46978920337696276492077915563657584800","183157231531449765306718324392737510389","36029252608112722951149085231464077096","165645734194294574156666850022256317245","21957338196104366232797480051530122807","226070555197556147849115588044770858801","23033546447266520076448388657959208475","44380752305369525304036336573871320507","8875234419546554987971242429390370357","295859213804557531174285412855549285850","269858899015258374928738988387316316389","204800135933546650328713181589254437017","102500287572422028087803859781865741054","88375505150979469912701707796271576433","266861521274678061445201486835118955392","79382976947162475593017386105973772997","255907993368761977372703949611905571297","283443642561525414361427558528814426679","249538682411400894012207610286821659040","263460080464593921536334076491495990365","39211753178525396621856061226181228730","160423602894325528355454238809077134441","288257787454237613254894209746610937916","196867847408428565539111784189321173150","269608201687103607074175832938810822895","273302304931803467783520585478331266240","301622945495645893015927478877252761899","230801963200498171412652055605478796778","244562835642218030782800044754988103668","129787634103621421595444403501232642497","280340182145462240020627645264934240791","23970676934202257636949858385460790536","121331162078010639831569504555116216383","143850725594552438631097822113191189597","41056259442804406217177549894370254494","204653873445265706322198345967986014408","45871608786139211003979540110251455586","91620518934436764740943505335299964836","184233957860494236297662471390085001654","70799813160337370436435538155382068508","68397097500265742700528655374379988847","172756600400050125139013528341397121034","75939397871438753172740970792758285740","72063982220134358877064411171065329717","101952058985966781052793812885683643820","147339276989636131290759895097504108168","298401780050507861957550433661328883816","189036981026839133508207066208931858935","37362791256026484122369277317928908078","330250465160444985701137230055183294060","133683228308549955219452819581486736103","172762421087192151274939688579565872295","112390029642476371935064288735410267757","57003859285307025057802998600332006031","292638530498327633389141562947190136816","181983579329905961913917027401969633968","243729119826789357872160736518168547873","119071006825108204655827407489130008817","82236480980804420589641475192053403015","84123015324143998763126903240420118076","268647239213574057967409354767566320857","122302172745638748254408299961081066351","135558160716214188550146550790860907911","298154791984906236059612210143695154310","73747604638981392241034438748212163201","227276111134485764015225795793935214719","147327580722327692807705863877787107572","146143784025237152339329526121125120922","183379698855733560806509174218920859541","216628819176825603862908918242355201886","333074141710635353878506192750459148821","235548046859164233232887215363599943534","39413838239218655962549959445746649069","199497057922404636721112714411460612357","127353618338591543729602978223916290400","4731315747903195802989249559476371592","252042949504298145275718986003355795424","273302304931803467783520585478331266240","301622945495645893015927478877252761899","230801963200498171412652055605478796778","118328207765141528462311155665468163582","180580874151126295946572944283558750336","169498437693315717353917485214619162403","106216121415372753128964900419891337690","8784501509506260877457334344224582669","176835896078433046583905411711083793930","190893941148840413865375198358888068111","72318248601119722593154376127728679744","90999333991406424103242308618715810190","12597998005262096989531516309655180982","183379698855733560806509174218920859541","108587633537507210242609878158511307392","295859213804557531174285412855549285850","269858899015258374928738988387316316389","204800135933546650328713181589254437017","102500287572422028087803859781865741054","88375505150979469912701707796271576433","266861521274678061445201486835118955392","74226886783090289859857933067713477678","290573187535161094325878110701060612484","140893979348088692092051799685547524595","64373427064790482870374082674790526346","328256093598803683806576689213665775980","142981004576341883537364734126250101639","263460080464593921536334076491495990365","39211753178525396621856061226181228730","160423602894325528355454238809077134441","288257787454237613254894209746610937916","196867847408428565539111784189321173150","145135061826835190457396673509569794773","200729736228531191894951850824378450209","115881889316960468100937505779571267248","114404261624791102279894493137666135351","335509173972065105790166786886246202765","237113860198826448260334785174622985876","280340182145462240020627645264934240791","269188354468485542591046308703973240587","303941933192156263768546614790587494205","45583142129621062449513429350370531952","257341183372916975294345505626835999833","263508044475846743289101874482100778293","297972824352236567181137848331940394488","211082535871240736691877689763826652219","249226409813884623491562769374920964704","136645640776204210784359296766203383960","229070163494383833945750765062391664704","316589586181102981679489189431788489935","52428138638864932711839215841065184572","215912981085986582769493883298145708512","69023798189421499387846179112145055213","301308041565653094313214196684076975408","307780992567899868343728271901614027309","99564064498469495394803452100091455536","151884881487097831387449605699339574954","243729119826789357872160736518168547873","329755948693828826647889476536379464331","116886332470201041917547546372344347865","37209185015806886165871324102552532828","122302172745638748254408299961081066351","135558160716214188550146550790860907911","298154791984906236059612210143695154310","73747604638981392241034438748212163201","27473337620494472295400403618173124587","240691624700510190984909202234507065602","295062633920943134203685781947578691749","253120649860172836298425133318000413114","216628819176825603862908918242355201886","333074141710635353878506192750459148821","295859213804557531174285412855549285850","269858899015258374928738988387316316389","204800135933546650328713181589254437017","102500287572422028087803859781865741054","88375505150979469912701707796271576433","266861521274678061445201486835118955392","303802059118163209492730664627470716000","35623988454579220325689203281742987409","163706458467075682923276362399057381543","204800135933546650328713181589254437017","102500287572422028087803859781865741054","88375505150979469912701707796271576433","266861521274678061445201486835118955392","228715457607586937167053031126294335694","335671546966235413770645689664220428734","308610350838502780848446619869402502027","223963712353141983575513196894021818808","14605060725268683506412489257590715980","247375904166865748744749554123782328833","45616142876371113985347754342239371730","50086891416234204738138407402262047730","49873199828281660864382091487577566126","181327597735463891401597291614662514086","57379722113042326333221254488523870746","291710468671789134466926743225070214384","184605205668167050697186702294036171535","326565991398841692958518649759597368947","90101698441274408746146394403809066745","79243075044410591164525532616415490360","243230967315749799605445437904556826282","74696357475446879304456099813992779085","189321840583238575303325813106277626827","253970114272636136436207795927184601435","144394850434730145749995598434648201147","78930263533565001350805014838539751823","337351748748099114520735745157128794638","68742213899975273094962316367695725229","218311635987838986022161420713304924521","28784850868993931413097782662981370799","101636292718877481178493767598704078767","171741020777094525486692599823961242689","337725359091330241239078293295331426197","12422987146788451617218567695290949919","45642063482557052061183855289134983895","171741020777094525486692599823961242689","337725359091330241239078293295331426197","217690628932048995925431302424676545218","329813999645099491825367217882068211429","19470038867640962461233779877853512901","79433942566156399008562500521777004054","190585287379530396729837485921908824054","114474711135671823737220103436031039473","82642299643313317849839392569574372119","141870181838002890693572769445741936048","233887142053919073405529540917616106749","220007713525977342646238990041050162972","340026779948028620995409190872745944454","268037866721174906582230438745809126394","275915171719953582820595348270207482075","314870074161451364349483672118676985706","68271717431951827827317262644049246962","171640506916060884723750602610918388244","40064869155830899520438389976176194975","277884309356560546623117158473612809607","133470674005868367610498511052153111167","69860352589152785890051037902137146197","234505315721703594085709176763910262788","92857458573664157313521639078633045421","309012836796547606442285042808807113060","14015986636789329150669406486466816925","84891233681513885481749366325936157270","102762294245011449112335653127204520350","247981073798368583359679940350739469684","297231003907629175304820920133637788999","287201031585877922000416909750517358093","192796104728787853873490683648037343250","42147340252102639697644748484998111183","2902921522769525532777570691325064191","339396126580894360464503385372600268731","247981073798368583359679940350739469684","297231003907629175304820920133637788999","47346481920653559786628874042232878080","201131879265652265140228123247906635795","337343199498135266239736206991663744690","266912606005682234488809315359908319323","143630056260589145895611706271282584021","340027348051377055276007820906403845303","54203253134525940524600178005442008413","259626214699146240324446074943493796502","223722809393250610513321855171637434969","197472594597192453332499285702946865730","122148430014585126046850746803597706050","286270335062780329454546455479897429016","235658121024273932970995444038823846965","165546585207474465287842260830245632979","127999324894165453539818328662472284946","6842868465935400515022282322372803342","188408218785424649413891463377654860149","98097009625419603272596672339588388929","250946056193613280497820863154380121612","19747066547151336978869042794127419155","243541463964915437819022428405338955187","292127740897823363271682347923072108483","322864385491176641824497903684925287103","182369681692530134218373614528995180595","287491363816199976946535176071735536977","255584513633745298238333192321033797566","296937159182802804551630165058513203649","214081044397561459805926599500677086355","51243659456514548656208706376299638452","243794025410026075135206396701113085979","310074448213863634731065930435630522892","299084846621577502618459341354350598452","334877019631110203766453616543932442216","201924251428223149848440854783289606346","278097529982568121017902741857169042932","125862384120772277334153082458530716208","113061686043718954373579756988667355991","90861565004641100593379812278969859291","236262439477962868027196034920589809819","165546585207474465287842260830245632979","127999324894165453539818328662472284946","226093554546240707094552853556684103214","305293893379720846206634711846195466507","163582412617241500197211539115647066877","23062190589627763237980736368777055126","291334371076769527230111309824582770553","88341182582837834784460601823870351991","239311545367357724098772130046689832654","164019106634566861154300910163365610254","84139280846262035666388097082377396347","324884671935932791039624043704148238546","1887137791114782822162865071850054099","313644878850162655341647347585552107717","203103102888906788182853961422345302423","58263412059756940901421169871687721425","266819765283286777502966762604383628281","22641782045562126430511933325199689534","151684126534324198132619050177375641220","3249615076776649825677969501894219191","333074141710635353878506192750459148821","208452006058657719670894197363232854254","180133219653365116546734989814464437872","326684462738347929806808466293739490183","312407901761314235525995619588681156505","239975877625032027662297343246141243495","333801112073727506988026859204024894411","109477461398744177705783260151351149621","63148585687925195939755690905608747816","266819765283286777502966762604383628281","22641782045562126430511933325199689534","151684126534324198132619050177375641220","180473450132449123341531071954641564163","108587633537507210242609878158511307392","63900428482940274405705458089381263106","97259794233200240183566245106597292521","85409181393783902377955392562156360957","245814087663601796979207616200484845812","237062983764822700478667186695843080601","10635626277959942679227160302106928599","323834872569857817212083405834520072258","233338141093886868629523978398237727035","297130314214872217188015096000038484871","317124248705785760286531323337376633302","312511634685782632921853248792231323777","244575105654630535179143316073564590265","93496170945573375431897256565339553415","329665074004687733194944848112390337592","145101500381846942707870524518355944649","71879169444419486744714103352504451070","86977528219621031797341731927718448833","320555083310190540274194626410023165227","160570557863465935476880810781171521196","261868588561300504544876802681374745822","115145026600468540669809627119799106955","257439501599435431352687763031512978434","314216384374730038287954631043403613898","60154926757966798540808032660034833951","143768110634999835235205396307390018386","32021167738410154571082229011242831692","133198753148155721802083164376413624527","46625767348879304412959503316091029375","70359796572783693044556989684313578981","139074246385868219682765612412148974034","336707651974893715098186525332041957881","22751789108332900714102714861857675548","30601239008974339844802487186169170531","277923303650643223657388407883773431935","179955959457049829973462814091172298309","105159215068403697134428844134290073785","38984994116057653468294295600235853266","227625213365240435171269540834346121846","126298859395851440707387940141648679592","166541472117869390775273465252716568743","47070261248017107581529860237661387148","121726151100909910916724701688864080919","272531509046001829063899638873365368321","27195515508352711290348267162450822245","95980648829190765255614628917061101412","27030359805890864979177034002743953341","41080546682170023966114037146665464010","151024168990179311454962593992151286134","321306785818122784139940561475635266986","141577278893409124277887321433597587439","81277949287802369702505398176326491419","161489974935515304456910906399989110622","16424618064506091968091909613840535301","106692399004011060156645715278201172772","69213114173010363267091711698045149981","44459498271905879115448313454994231435","83049232485204544922829368137717815954","26900252330486624781172184567815417586","169655890141540460413058551548219341207","225962592190426218470258384284235190808","35854464891220035900016239896900657185","17447007617547634488338805680305924510","188691582261263481687326589852186483287","307952719303163304989839158763727546611","89312307374499100715002257805527575064","314299883274508514856319005443255631196","48691756483603160588497959107759976831","31892294137359600060227648388535872479","11364029035383154261443697494951169901","166943441542525749952100181096097614131"]},"deprecated":false},{"signature_version":"v1","target":{"file":"demo/GPMF_demo.c","function":"main"},"source":"https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681","signature_type":"Function","id":"CVE-2019-15148-559f5e6e","digest":{"function_hash":"112309568183522935452138474765368916680","length":4146},"deprecated":false},{"signature_version":"v1","target":{"file":"demo/GPMF_mp4reader.c","function":"SavePayload"},"source":"https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681","signature_type":"Function","id":"CVE-2019-15148-6d2f8258","digest":{"function_hash":"56152100313656301596003533897687335226","length":363},"deprecated":false},{"signature_version":"v1","target":{"file":"demo/GPMF_mp4reader.c","function":"OpenMP4SourceUDTA"},"source":"https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681","signature_type":"Function","id":"CVE-2019-15148-7a9a6ad2","digest":{"function_hash":"167263005128393394717982571156485361868","length":1925},"deprecated":false},{"signature_version":"v1","target":{"file":"demo/GPMF_mp4reader.c","function":"GetGPMFSampleRate"},"source":"https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681","signature_type":"Function","id":"CVE-2019-15148-878a7d64","digest":{"function_hash":"308829942913996618897187027223291412275","length":3505},"deprecated":false},{"signature_version":"v1","target":{"file":"demo/GPMF_mp4reader.c","function":"GetGPMFSampleRateAndTimes"},"source":"https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681","signature_type":"Function","id":"CVE-2019-15148-9aec042a","digest":{"function_hash":"82191641170797928770901185607834087346","length":1138},"deprecated":false},{"signature_version":"v1","target":{"file":"GPMF_parser.h"},"source":"https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681","signature_type":"Line","id":"CVE-2019-15148-a2283642","digest":{"threshold":0.9,"line_hashes":["98549373270153262601702557021324638612","318687684856589025215120356241263192374","326778892889914318396148082828569148850","271701333916577321285229360292707941113","314821972862919757006191335647978412291"]},"deprecated":false},{"signature_version":"v1","target":{"file":"demo/GPMF_mp4reader.c","function":"GetPayloadTime"},"source":"https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681","signature_type":"Function","id":"CVE-2019-15148-b81ae2d7","digest":{"function_hash":"332772153430254565659925528026282582778","length":540},"deprecated":false},{"signature_version":"v1","target":{"file":"demo/GPMF_mp4reader.c","function":"GetPayload"},"source":"https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681","signature_type":"Function","id":"CVE-2019-15148-fd1d1416","digest":{"function_hash":"170001170694621469841554348744719020973","length":472},"deprecated":false}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}