CVE-2017-14169 in FFmpeg
Summary
In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3, an integer signedness error might occur when a crafted file, which claims a large "item_num" field such as 0xffffffff, is provided. As a result, the variable "item_num" turns negative, bypassing the check for a large value.
Reservation
09/07/2017
Disclosure
09/07/2017
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 106185 | FFmpeg mxfdec.c mxf_read_primer_pack input validation | 20 | Not defined | Official fix | CVE-2017-14169 |