Integer Underflow in GStreamer Library Affects Media Applications

CVE-2024-47606

What is CVE-2024-47606?

An integer underflow vulnerability has been detected in the GStreamer library, specifically within the function qtdemux_parse_theora_extension in qtdemux.c. The flaw arises when an underflow occurs in the gint size variable, causing it to hold an excessively large unintended value upon being cast to an unsigned integer. This negative 32-bit value is then improperly cast to a 64-bit unsigned integer during the execution of the gst_buffer_new_and_alloc function. The subsequent memory allocation attempt results in insufficient memory being allocated, exacerbating the issue. During the gst_buffer_fill operation, data from input files could potentially overwrite critical structures in memory, leading to a critical situation where function pointers may be hijacked. This vulnerability has been addressed in version 1.24.10 of GStreamer.

References