Posted by Ron E on Sep 08
A signed integer overflow exists in FFmpeg’s udp.c implementation when
parsing the fifo_size option from a user-supplied UDP URL. The overflow
occurs during multiplication, which is used to compute the size of the
circular receive buffer. This can result in undefined behavior, allocation
failures, or potentially memory corruption depending on compiler
optimizations and downstream usage. (FFmpeg 7.0-8.0))
*Impact:*
–
Denial of Service…
– Read More – Full Disclosure
