ffjpeg through 2020-02-24 has an invalid write in bmp_load in bmp.c.
Published May 25, 2020.
Ffjpeg Project Ffjpeg