Description
A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loop and adds `sc->ctts_data[i].count` to `sc->sample_offsets_count`. This can lead to an integer overflow resulting in a small allocation with `av_calloc()`. An attacker can cause remote code execution via a malicious mp4 file. We recommend upgrading past commit c953baa084607dd1d84c3bfcce3cf6a87c3e6e05
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
FFMPEG FFMPEG
5.1 to < unspecifiedaffectedab77b878f1205225c6de1370fb0e998dbcc8bc69 to < unspecifiedaffectedunspecified to < c953baa084607dd1d84c3bfcce3cf6a87c3e6e05affected