Wenjie Yin

FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in v4l2 buffer swframe to buf() in libavcodec/v4l2 buffers.c because cumulative plane offsets are not checked against the V4L2 buffer length. Attackers can supply crafted video whose dimensions or padding cause unsigned wraparound in v4l2 bufref to buf(), making memcpy() write past the mmaped driver buffer during V4L2 M2M encoding.

FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2 buffer swframe to buf() in libavcodec/v4l2 buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 M2M encoder, crashing the application or leaking heap memory into encoded output.