Libav AVI File Parser Null Pointer Dereference Vulnerability

A null pointer dereference vulnerability has been identified in Libav versions through 12.3, specifically within the AVI file parser component. The issue arises in the 'av_buffer_unref' function of 'libavutil/buffer.c', where a NULL function pointer is called during buffer management, leading to a segmentation fault. This vulnerability requires local access to exploit and affects unsupported versions of Libav.

Impact

Exploitation of this vulnerability causes a segmentation fault, leading to a crash of the application.

Reproduction

The vulnerability can be reproduced using 'avconv' to process a malformed AVI file encoded with the CFHD codec. This can be done by specifying the file as input and directing the output to 'null', which will trigger the null pointer dereference and cause a segmentation fault.