Описание
FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU size values are sign-flipped by the narrowing cast, producing a negative value that passes the payload size check. This allows an oversized OBU to bypass the safety bound on affected platforms, leading to out-of-bounds memory access when the oversized value is subsequently used as a copy length.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| ffmpeg | unfixed | package | ||
| ffmpeg | not-affected | trixie | package | |
| ffmpeg | not-affected | bookworm | package | |
| ffmpeg | not-affected | bullseye | package |
Примечания
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24090
Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b4c199c5906ff53368926c2a5839881f41957e7f (master)
Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/7646bb4c42e6837a9396c3d9ab8d8cf476e2053b (n9.0.1)
Introduced by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/330c8f8b936de66d08d5c462845e7fdcbc637b75 (n8.0)
EPSS
Связанные уязвимости
(FFmpeg before commit b4c199c contains an incorrect integer narrowing c ...)
FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU size values are sign-flipped by the narrowing cast, producing a negative value that passes the payload size check. This allows an oversized OBU to bypass the safety bound on affected platforms, leading to out-of-bounds memory access when the oversized value is subsequently used as a copy length.
FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU size values are sign-flipped by the narrowing cast, producing a negative value that passes the payload size check. This allows an oversized OBU to bypass the safety bound on affected platforms, leading to out-of-bounds memory access when the oversized value is subsequently used as a copy length.
EPSS