GStreamer Buffer Overwrite Vulnerability

CVE-2024-47539

What is CVE-2024-47539?

A vulnerability exists in the GStreamer library, specifically within the convert_to_s334_1a function located in isomp4/qtdemux.c. This flaw originates from a mismatch between the allocated memory size for the storage array and the loop condition i * 2 < ccpair_size. When ccpair_size is even, the allocated storage does not align with the expected bounds, leading to the potential for an out-of-bounds write that can overwrite memory beyond the designated limits. This issue can result in unintended behavior or crashes in applications utilizing GStreamer for media processing. An important patch has been released in version 1.24.10 to resolve this vulnerability.

References