[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Aug 2011 10:04:34 -0400
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
Cc: ocert-announce@...ts.ocert.org
Subject: Re: [oCERT-2011-002] libavcodec insufficient boundary check
On Wed, Aug 10, 2011 at 9:19 AM, Daniele Bianco <danbia@...rt.org> wrote:
>
> #2011-002 libavcodec insufficient boundary check
>
> Description:
>
> The libavcodec library, an open source video encoding/decoding library part
> of the FFmpeg and Libav projects, performs insufficient boundary check
> against a buffer index. The missing check can result in arbitrary read/write
> of data outside a destination buffer boundaries.
>
> The vulnerability affects the Chinese AVS video (CAVS) file format decoder,
> specially crafted CAVS files may lead to arbitrary code execution during
> decoding.
>
While you're at it, here are a couple more:
* Out-of-bounds read on lines 166-171 due to signedness error
* Out-of-bounds read on lines 224-240 due to signedness error
Line numbers based on upstream git:
http://git.videolan.org/?p=ffmpeg.git;a=blob;f=libavcodec/cavsdec.c;h=acf040788c9a4c34807ba2efa10312b5b8e84f02;hb=6481a36010d8f7d834676f17ba555d0a3815c760
Hint to distributions and software developers: if you're going to use
libavcodec (or libavformat, etc.) for your project, consider
restricting the default build to include only *commonly* used codecs
and demuxers. The code quality of many of the more obscure formats is
questionable at best.
Regards,
Dan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
