Security researchers from Google have discovered a vulnerability (CVE-2022-2566) in the libavformat library, part of the FFmpeg multimedia package. This vulnerability allows an attacker to execute code on the victim's system when processing a specially crafted mp4 file. The vulnerability manifests starting from the FFmpeg 5.1 branch and has been fixed in the FFmpeg 5.1.2 release.
The vulnerability is caused by a buffer size calculation error in the build_open_gop_key_points() function, leading to an integer overflow when processing certain parameters and allocating a memory block smaller than required. A prototype exploit has been published to demonstrate the potential for an attack.
Source: opennet.ru
