Integer Underflow Vulnerability in GStreamer Library by Freedesktop

CVE-2024-47546

What is CVE-2024-47546?

An integer underflow has been identified in the GStreamer library, specifically within the extract_cc_from_data function located in qtdemux.c. This vulnerability occurs in the FOURCC_c708 case, where subtracting 8 from the atom_length may result in an underflow scenario if atom_length is less than 8. As a consequence of this underflow, the value of *cclen can become a large number, leading to potential out-of-bounds (OOB) read when cclen is subsequently passed to g_memdup2. Users are advised to upgrade to GStreamer version 1.24.10 or later to mitigate this issue.

References