Null Pointer Dereference in GStreamer Library from Vendor Freedesktop

CVE-2024-47835

What is CVE-2024-47835?

A vulnerability in the GStreamer library's parse_lrc function allows for a null pointer dereference due to improper handling of strings that do not contain the expected closing character '>'. When the strchr() function is called and the character is not found, it returns a NULL pointer. This NULL pointer is then improperly used in the g_strdup() function, leading to potential application crashes. The vulnerability has been addressed in version 1.24.10, eliminating the risk associated with this code path.

References