GitHub Advisoryadvisory · crates.io

GHSA-mc39-h54g-pvw6 libdav1d-sys affected by dav1d AV1 decoder integer overflow

MEDIUM Published 2024-04-05 Modified 2024-04-05 Official page ↗
Ecosystem
crates.io
Packages
libdav1d-sys
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
Weaknesses
CWE-190
Reviewed
2024-04-05

Affected packages

• crates.io libdav1d-sys: < 0.7.0 → fixed in 0.7.0

Description

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading to version 0.7.0 of libdav1d-sys, which includes dav1d 1.4.0.

Related

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References