Memory Leak Vulnerability in FFmpeg AVI Decoder
Summary
CVE-2016-7555: The avi_read_header function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to memory leak when decoding an AVI file that has a crafted "strh" structure. Affects ffmpeg across 2 version ranges.
< 3.0.7-r0
< c46d22a4a58467bdc7885685b06a2114dd181c43
Fixed in 3.0.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a popular open-source multimedia framework used for decoding, encoding, and transcoding various audio and video formats. It provides a set of libraries and command-line tools that enable developers to work with multimedia files. The AVI (Audio Video Interleave) format is a common container format for audio and video data. FFmpeg includes an AVI decoder called avidec.c, which is responsible for parsing and decoding AVI files. However, versions of FFmpeg prior to 3.1.4 are vulnerable to a memory leak when decoding AVI files that contain a specially crafted "strh" structure.
Vulnerability Detail
The vulnerability (CVE-2016-7555) originates from a flaw in the avi_read_header function within libavformat/avidec.c. When processing an AVI file, this function fails to properly release allocated memory in certain cases. As a result, an attacker can create a malicious AVI file with a crafted "strh" structure, causing the decoder to leak memory. This memory leak can lead to resource exhaustion, potentially crashing the application or allowing for further exploitation.
How To Fix
Minimum fixed version
3.0.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading FFmpeg is not immediately feasible, a temporary workaround is to avoid processing AVI files from untrusted or unknown sources. By limiting the exposure to potentially malicious AVI files, the risk of exploitation can be mitigated.
Conclusion
The memory leak vulnerability in the AVI decoder of FFmpeg (CVE-2016-7555) can be exploited by crafting a malicious AVI file. Upgrading to FFmpeg version 3.0.7-r0 or later is recommended to mitigate this vulnerability. If immediate upgrade is not possible, exercising caution when processing AVI files from untrusted sources can help reduce the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ffmpeg →
FAQ
FFmpeg is an open-source multimedia framework used for working with audio and video files. It provides libraries and tools for decoding, encoding, and transcoding various multimedia formats.
AVI (Audio Video Interleave) is a common multimedia container format used for storing audio and video data. It allows for the simultaneous playback of audio and video streams.
avidec.c is a component of FFmpeg responsible for decoding AVI files. It parses the structure of AVI files and extracts audio and video data for further processing.
A memory leak occurs when a program fails to release allocated memory after it is no longer needed. This can lead to a gradual depletion of available memory, potentially causing performance issues or crashes.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your FFmpeg version is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will provide real-time alerts for open-source vulnerabilities, including this memory leak vulnerability in FFmpeg.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
