FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14212
Reference (s):
- GENTOO:GLSA-202007-58
- URL: https://security.gentoo.org/glsa/202007-58
- https://patchwork.ffmpeg.org/project/ffmpeg/list/?series=1463
- https://trac.ffmpeg.org/ticket/8716