CVE-2021-40417

When parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that were submitted with the job along with fields that were parsed for the submitted video by the R3D SDK to calculate the size of a heap buffer. Due to an integer overflow with regards to this calculation, this can result in an undersized heap buffer being allocated. When this heap buffer is written to, a heap-based buffer overflow will occur. This can result in code execution under the context of the application.

When parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that were submitted with the job along with fields that were parsed for the submitted video by the R3D SDK to calculate the size of a heap buffer. Due to an integer overflow with regards to this calculation, this can result in an undersized heap buffer being allocated. When this heap buffer is written to, a heap-based buffer overflow will occur. This can result in code execution under the context of the application.

Cuando es analizado un archivo que es enviado al servicio DPDecoder como un trabajo, el servicio usará la combinación de parámetros de decodificación que fueron enviados con el trabajo junto con los campos que fueron analizados para el vídeo enviado por el SDK de R3D para calcular el tamaño de un búfer de la pila. Debido a un desbordamiento de enteros con respecto a este cálculo, puede asignarse un búfer de montón de tamaño insuficiente. Cuando es escrito en este búfer de la pila, es producido un desbordamiento del búfer en la región heap de la memoria. Esto puede resultar en una ejecución de código bajo el contexto de la aplicación