Open xiaoxiongwang opened 4 years ago
CVE-2020-13440 has been assigned to this issue.The link is here.
new commit e63a75fdc2ba931c90445037b225170c6c31ce5d fix this issue @xiaoxiongwang please check and test.
The testcase is lost, @xiaoxiongwang could you please upload again?
Tested in Ubuntu 16.04, 64bit.
The testcase is segv_ffjpeg_e1.
I use the following command:
and get:
I use valgrind to analysis the bug and get the below information (absolute path information omitted):
I use AddressSanitizer to build ffjpeg and running it with the following command:
This is the ASAN information (absolute path information omitted):
An attacker can exploit this vulnerability by submitting a malicious bmp that exploits this bug which will result in a Denial of Service (DoS).