CVE-2024-47778

A flaw was found in the GStreamer library. Various out-of-bounds reads in the WAV parser can cause crashes for certain input files, potentially allowing a malicious actor to trigger an application crash.

This update for gstreamer-plugins-good fixes the following issues. Fixed an uninitialized stack memory in Matroska/WebM demuxer. Fixed an out-of-bounds write in isomp4/qtdemux.c. Fixed an out-of-bounds write in convert_to_s334_1a. Fixed an out-of-bounds write in qtdemux_parse_container. Fixed a NULL-pointer dereferences in MP4/MOV demuxer CENC handling. Fixed an integer underflow in FOURCC_strf parsing leading to out-of-bounds read. Fixed an integer underflow in extract_cc_from_data leading to out-of-bounds read. Fixed an integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads. Fixed an out-of-bounds reads in MP4/MOV demuxer sample table parser. Fixed MP4/MOV sample table parser out-of-bounds read. Fixed insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences. Fixed a NULL-pointer dereference in Matroska/WebM demuxer. Fixed a NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer. Fixed a NULL-pointer dereference in Matroska/WebM demuxer. Avoid integer overflow when allocating sysmem. Fixed an integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes. Fixed a NULL-pointer dereference in gdk-pixbuf decoder. Fixed an integer overflow in AVI subtitle parser that leads to out-of-bounds reads. Fixed various out-of-bounds reads in WAV parser. Fixed various out-of-bounds reads in WAV parser. Fixed various out-of-bounds reads in WAV parser. Fixed various out-of-bounds reads in WAV parser. Fixed a use-after-free in the Matroska demuxer that can cause crashes for certain input files.