#9155: Backporting of fixes for CVE-2020-35965/oss-fuzz issue 26532 to FFmpeg
4.3
-------------------------------------+-------------------------------------
Reporter: diabonas | Owner:
Type: defect | Status: closed
Priority: normal | Component: avcodec
Version: unspecified | Resolution:
| needs_more_info
Keywords: | Blocked By:
Blocking: | Reproduced by developer: 0
Analyzed by developer: 0 |
-------------------------------------+-------------------------------------
Comment (by diabonas):
I am afraid I don't have the capacity to verify the testcase myself: it is
not a simple FFmpeg crash, but a heap buffer write overflow found using an
address sanitiser during fuzzing. I currently lack the disk space to run
the official oss-fuzz Dockerfiles as described on https://google.github.io
/oss-fuzz/advanced-topics/reproducing/ (these become ''huge'' quickly),
and I am not familiar enough with the FFmpeg codebase to know how to build
it with ASAN enabled.
My suggestion would be backporting commit
b0a8b40294ea212c1938348ff112ef1b9bf16bb3 to the 4.3 branch just out of
caution, but obviously this is not for me to decide.
--
Ticket URL: <https://trac.ffmpeg.org/ticket/9155#comment:4>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker
_______________________________________________
FFmpeg-trac mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-trac
To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".
