Skip to content

avidemux: Fix integer overflow resulting in heap corruption in DIB buffer inversion code

Tim-Philipp Müller requested to merge tpm/gstreamer:sec-1224-avidemux into main

Check that width*bpp/8 doesn't overflow a guint and also that height*stride fits into the provided buffer without overflowing.

Thanks to Adam Doupe for analyzing and reporting the issue.

CVE: CVE-2022-1921

See https://gstreamer.freedesktop.org/security/sa-2022-0001.html

Fixes #1224 (closed)

Edited by Tim-Philipp Müller

Merge request reports