ffmpeg-6
Chainguard
Status
Justification
Impact
The showwaves buffer overflow vulnerability has been fixed in FFmpeg 6.1.2. The fix (commit 08bd2cbfeb) added a check for history_nb_samples <= 0 at libavfilter/avf_showwaves.c:441-446. This prevents invalid buffer allocation when av_rescale returns 0 or negative values. Without the check, av_calloc(0, ...) would return NULL, causing crashes when later code accesses showwaves->history[i]. The fix ensures the function returns an error before any invalid allocation occurs.
Status