Libaom

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

libaom: libaom: remote code execution via SVC layer context handling with attacker-controlled frames

libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack

libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers: * Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations…

Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc().

aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow.

aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.

aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.