Bugzilla – Bug 1173019
VUL-0: CVE-2020-14212: ffmpeg: heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c
Last modified: 2021-06-01 01:46:33 UTC
CVE-2020-14212 FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14212 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14212 https://trac.ffmpeg.org/ticket/8716 https://patchwork.ffmpeg.org/project/ffmpeg/list/?series=1463
ffmpeg in SLE does not support dnn_backend_native yet and therefore is not affected.
Created attachment 838882 [details] 10.jpg (reproducer part 1/2)
Created attachment 838883 [details] crash_dnn_backend_native_1 (reproducer part 2/2)
>I compiled ffmpeg on Ubuntu 18.04 with the following configuration: >--cc=clang --extra-cflags='-O0 -g3 -fsanitize=address -Wno-error -fPIC' --extra-ldflags='-O0 -g3 -fsanitize=address -Wno-error -fPIC' --enable-debug --disable-asm --disable-optimizations --disable-shared --enable-libopenjpeg --enable-gpl --enable-libass --enable-libfdk-aac --enable-libmp3lame --enable-libopus --enable-libtheora --enable-libvorbis --enable-libvpx --enable-libx264 --enable-nonfree >the bug could be reproduced while running the following command line: >ffmpeg -v debug -i 10.jpg -vf format=rgb24,sr=dnn_backend=native:model=crash_dnn_backend_native_1 derain.jpg