Codec

FFmpeg RASC Decoder DLTA Heap Out-of-Bounds Write

FFmpeg's RASC decoder (decodedlta() in libavcodec/rasc.c) tracks a row cursor and only checks whether it has reached the end of the current row after certain operations, rather than before. Several DLTA run types (4, 7, 12, 13) perform 32-bit reads/writes at…