Posted by Ron E on Sep 08
The ladspa audio filter implementation (libavfilter/af_ladspa.c) in FFmpeg
allows unsanitized environment variables to influence dynamic library
loading. Specifically, the filter uses getenv(“LADSPA_PATH”) and
getenv(“HOME”) when resolving the plugin shared object (.so) name provided
through the file option. These values are concatenated into a filesystem
path and passed directly into dlopen() without validation or…
– Read More – Full Disclosure
