Buffer overflow in libavi_plugin memmove() call

How it was found

Summary: When parsing an invalid AVI file, a buffer overflow might occur.

Description: The ReadFrame function in the avi.c file uses a variable i_width_bytes, which is obtained directly from the file. It is a signed integer. It does not do a strict check before the memory operation(memmove, memcpy), which may cause a buffer overflow.

Steps To Reproduce:

1.) Open vlc.exe with windbg 2.) F5 makes the program run 3 ) Drag poc files into vlc 4.) Monitor the crash from WinDBG

vlc version 3.0.6 x64 system version win7 x64

More relevant information and poc in the attachment

Impact

If successful, a malicious third party could trigger an invalid memory access, leading to a crash of the process of the VLC media player. May cause remote code execution.