ffmpeg-6
Chainguard
Status
Justification
Impact
The stereowiden buffer overflow vulnerability has been comprehensively fixed in FFmpeg 6.1.2. Two key fixes are present: (1) The 2016 fix (commit 906ee41141) completely rewrote the buffer handling logic to check bounds before any writes, eliminating the race condition. (2) The 2023 fix (commit 50f0f8c53c) added zero-length validation. Current code in libavfilter/af_stereowiden.c shows both fixes implemented - the processing loop checks boundaries before pointer arithmetic (lines 115-130) and initialization includes zero-length check (lines 72-77).
Status