FFmpeg MOV Parser Null Pointer Dereference Vulnerability

A null pointer dereference vulnerability has been identified in FFmpeg versions prior to 7.1. The issue arises in the MOV parser component, specifically within the 'mov_read_trak' function in 'libavformat/mov.c'. This vulnerability requires local access to exploit.

Impact

Exploitation of this vulnerability leads to a null pointer dereference, which can cause a crash or undefined behavior in the application.

Reproduction

The vulnerability can be reproduced by using FFmpeg to process a crafted MOV file that triggers the null pointer dereference in the 'mov_read_trak' function. This can be done by using the FFmpeg command-line tool with the 'libavformat' library.

Remediation

Users are advised to upgrade to FFmpeg version 7.1 or later, where this vulnerability has been fixed.