Michael Niedermayer

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726 decode frame() in libavcodec/g726.c because it ignores init get bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer, crashing the process.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv decode inter() in libavcodec/eatgv.c that ignores init get bits() failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section, crashing the process for denial of service.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c because decode frame() ignores init get bits() failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads from a NULL buffer and crashing the process.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble decode frame() in libavcodec/vble.c because it ignores init get bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that crash the process.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode frame() in libavcodec/bink.c ignores init get bits() failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for denial of service.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mp decode frame() ignores init get bits() failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the process.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqi decode frame() in libavcodec/eatqi.c, which ignores init get bits() failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial of service.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decode frame() reads from a NULL buffer and causes denial of service.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp decode frame() in libavcodec/mpegaudiodec template.c because init get bits() failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing reads through a NULL buffer that crash the process.

FFmpeg through 9.0.2 contains an infinite loop vulnerability in bit allocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits negative, causing the reduction loop to never terminate and consuming 100% CPU.

FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decode frame() never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so draw n color() writes uninitialized stack bytes into decoded frames, disclosing stack memory contents.

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows attackers to leak stack contents by triggering failed RLE unpacking. Attackers can supply a crafted Tiertex SEQ file so seq decode op1() copies an uninitialized 64-byte stack block into decoded frames, exposing stack memory in visible output.

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw decode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with truncated low bit depth rawvideo packets to leak uninitialized heap memory through decoded frame output.

FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8 lossy decode alpha() in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width * height to disclose stale pixel data from previously decoded frames.

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into decoded frames, disclosing heap contents.

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder's decode frame() in libavcodec/exr.c that miscalculates the tiled block count. Attackers can supply a crafted tiled OpenEXR image with large dimensions and small tiles to skip decoding and disclose uninitialized memory or stale frame data.

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap bytes from screendta to appear in decoded output.

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in tak decode frame() in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting channels from the list, causing undecoded sample buffers to leak heap memory through decoded audio.

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff mlz decompression() in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized heap bytes into decoded audio output.

FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape decode frame() in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale allocations and cause denial of service.