An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains an invalid pointer dereference in gflistcount in utils/list.c that can cause a denial of service via a crafted MP4 file.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-20631.json"