—

RUSTSEC-2024-0016

dav1d AV1 decoder integer overflow

Details

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading to version 0.7.0 of libdav1d-sys, which includes dav1d 1.4.0

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/libdav1d-sys

Introduced in: 0.0.0-0Fixed in: 0.7.0

Upgrade libdav1d-sys to 0.7.0 or newer (ecosystem crates.io).

References

https://crates.io/crates/libdav1d-sys[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2024-0016.html[ADVISORY]
https://www.cvedetails.com/cve/CVE-2024-1580/[WEB]