FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted.
The product writes data past the end, or before the beginning, of the intended buffer.
Link | Tags |
---|---|
https://trac.ffmpeg.org/ticket/8716 | patch vendor advisory |
https://patchwork.ffmpeg.org/project/ffmpeg/list/?series=1463 | not applicable vendor advisory |
https://security.gentoo.org/glsa/202007-58 | third party advisory vendor advisory |