CVE-2025-59730

When decoding a frame for a SANM file ANIM v0 variant, the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify their resolution width x height. A buffer of appropriate size is allocated depending on the resolution. This codec can encode the frame...

CVE-2025-59734: Use After Free

It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion storedframe. Stored frames can later be referenced by FTCH chunks. For files using subversion storedframe. Leaving ctx-hasdimensions set to false. A subsequent chunk with type...

CVE-2025-59730: Out-of-bounds Write

When decoding a frame for a SANM file ANIM v0 variant, the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify their resolution width x height. A buffer of appropriate size is allocated depending on the resolution. This codec can encode the frame...

ffmpeg:ffmpeg_AV_CODEC_ID_SANM_fuzzer: Heap-buffer-overflow in process_frame_obj

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5466731806261248 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDSANMfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x7db5358caee4...

CVE-2013-0862: Undefined Security Weakness

Multiple integer overflows in the processframeobj function in libavcodec/sanm.c in FFmpeg before 1.1.2 allow remote attackers to have an unspecified impact via crafted image dimensions in LucasArts Smush video data, which triggers an out-of-bounds array access...

CVE-2013-3675

The processframeobj function in sanm.c in libavcodec in FFmpeg before 1.2.1 does not validate width and height values, which allows remote attackers to cause a denial of service integer overflow, out-of-bounds array access, and application crash via crafted LucasArts Smush video data...

CVE-2013-3675: Improper Input Validation

The processframeobj function in sanm.c in libavcodec in FFmpeg before 1.2.1 does not validate width and height values, which allows remote attackers to cause a denial of service integer overflow, out-of-bounds array access, and application crash via crafted LucasArts Smush video data...