{"id":"CVE-2022-29340","details":"GPAC 2.1-DEV-rev87-g053aae8-master. has a Null Pointer Dereference vulnerability in gf_isom_parse_movie_boxes_internal due to improper return value handling of GF_SKIP_BOX, which causes a Denial of Service. This vulnerability was fixed in commit 37592ad.","modified":"2026-08-12T13:00:42.861927Z","published":"2022-05-05T12:46:44Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29340.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29340.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29340"},{"type":"REPORT","url":"https://github.com/gpac/gpac/issues/2163"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/37592ad86c6ca934d34740012213e467acc4a3b0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"0"},{"fixed":"37592ad86c6ca934d34740012213e467acc4a3b0"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v2.0.0","v1.0.0","v0.9.0","v0.9.0-preview","v0.6.0","v0.5.2"],"database_specific":{"vanir_signatures":[{"target":{"file":"src/isomedia/box_funcs.c","function":"gf_isom_box_parse_ex"},"deprecated":false,"digest":{"function_hash":"204068561095793227767970056049160792601","length":6455},"id":"CVE-2022-29340-08de3dfc","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/37592ad86c6ca934d34740012213e467acc4a3b0"},{"target":{"file":"src/isomedia/isom_intern.c"},"deprecated":false,"digest":{"line_hashes":["208719525030907384854481309931149601407","262414055590553386709960339212000700456","287494547593792256990466025884189760229"],"threshold":0.9},"id":"CVE-2022-29340-a080898f","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/37592ad86c6ca934d34740012213e467acc4a3b0"},{"deprecated":false,"digest":{"length":13880,"function_hash":"301523011820018470228411233188860826431"},"id":"CVE-2022-29340-a80636b0","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/37592ad86c6ca934d34740012213e467acc4a3b0","target":{"file":"src/isomedia/isom_intern.c","function":"gf_isom_parse_movie_boxes_internal"}},{"id":"CVE-2022-29340-e33b0f64","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/37592ad86c6ca934d34740012213e467acc4a3b0","target":{"file":"src/isomedia/box_funcs.c"},"deprecated":false,"digest":{"line_hashes":["188659798654361141089446755525976142299","332096073280269677175276025375831051751","308736001611605449345004818850539433779","130047476379767080417330509558579352648","134413338311360461268850345585908468640"],"threshold":0.9}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29340.json","vanir_signatures_modified":"2026-08-12T13:00:42Z"}}],"schema_version":"1.9.0"}