CVE-2024-47606

A flaw was found in the MP4/MOV demuxer and memory allocator in the GStreamer library. Processing a specially crafted input file can cause an integer overflow in the qtdemux_parse_theora_extension function. This issue leads to a small amount of memory being allocated to store a large input size, resulting in an out-of-bounds write.

This update for gstreamer-plugins-good fixes the following issues. Fixed an uninitialized stack memory in Matroska/WebM demuxer. Fixed an out-of-bounds write in isomp4/qtdemux.c. Fixed an out-of-bounds write in convert_to_s334_1a. Fixed an out-of-bounds write in qtdemux_parse_container. Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read. Fixed an integer underflow in extract_cc_from_data leading to out-of-bounds read. Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser. Fixed MP4/MOV sample table parser out-of-bounds read. Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. Fixed a NULL-pointer dereference in Matroska/WebM demuxer. Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. Fixed a NULL-pointer dereference in Matroska/WebM demuxer. Avoid integer overflow when allocating sysmem. Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. Fixed a NULL-pointer dereference in gdk-pixbuf decoder. Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads. Fixed various out-of-bounds reads in WAV parser. Fixed various out-of-bounds reads in WAV parser. Fixed various out-of-bounds reads in WAV parser. Fixed various out-of-bounds reads in WAV parser. Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files.