A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Affected is the function lsr_translate_coords of the file laser/lsr_dec.c. The manipulation leads to integer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is b3d821c4ae9ba62b3a194d9dcb5e99f17bd56908. It is recommended to apply a patch to fix this issue. VDB-214518 is the identifier assigned to this vulnerability.
- [X] I looked for a similar issue and couldn't find any.
- [X] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/

Hi, a CVE was issued affecting gpac and I wasn't able to find any report here or any fix. [VulDB has a "writeup"](https://vuldb.com/?id.214518), which links to an [advisory in Google Drive](https://drive.google.com/file/d/1HVWa6IpAbvsMS5rx091RfjUB4GfXrMLE/view), which [links to a reproducer](https://drive.google.com/file/d/170O0RtI03P1z4gE_ilRZQVS1w7uE7tX9/view?usp=sharing)

I can indeed reproduce when built from 4112fc3562a67508b4be9f7760d8b7ae1ee00f27 (current HEAD at the time of writing):

```
# MP4Box -bt /poc-integer-Overflow                                                                                       
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Unknown box type drzf in parent dinf
[iso file] Missing dref box in dinf
[iso file] Incomplete box mdat - start 11495 size 853090
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Unknown box type drzf in parent dinf
[iso file] Missing dref box in dinf
[iso file] Incomplete box mdat - start 11495 size 853090
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 LASeR Scene Parsing
[LASeR] sameg coded in bitstream but no g defined !
Reading 515 bits but max should be 64, skipping 451 most significants bits
laser/lsr_dec.c:856:27: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
```
Integer Overflow in function lsr_translate_coords at laser/lsr_dec.c:856 (CVE-2022-4202)
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Integer Overflow in function lsr_translate_coords at laser/lsr_dec.c:856 (CVE-2022-4202)
Issue date:

--- start body ---
- [X] I looked for a similar issue and couldn't find any.
- [X] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/

Hi, a CVE was issued affecting gpac and I wasn't able to find any report here or any fix. [VulDB has a "writeup"](https://vuldb.com/?id.214518), which links to an [advisory in Google Drive](https://drive.google.com/file/d/1HVWa6IpAbvsMS5rx091RfjUB4GfXrMLE/view), which [links to a reproducer](https://drive.google.com/file/d/170O0RtI03P1z4gE_ilRZQVS1w7uE7tX9/view?usp=sharing)

I can indeed reproduce when built from 4112fc3562a67508b4be9f7760d8b7ae1ee00f27 (current HEAD at the time of writing):

```
# MP4Box -bt /poc-integer-Overflow                                                                                       
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Unknown box type drzf in parent dinf
[iso file] Missing dref box in dinf
[iso file] Incomplete box mdat - start 11495 size 853090
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Unknown box type drzf in parent dinf
[iso file] Missing dref box in dinf
[iso file] Incomplete box mdat - start 11495 size 853090
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 LASeR Scene Parsing
[LASeR] sameg coded in bitstream but no g defined !
Reading 515 bits but max should be 64, skipping 451 most significants bits
laser/lsr_dec.c:856:27: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
```
--- end body ---

An integer overflow vulnerability in the function lsr_translate_coords of GPAC allows attackers to exploit the application by providing specially crafted input, leading to potential Denial of Service (DoS) or arbitrary code execution. This issue is documented as CVE-2022-4202.