CVE-2024-47540: GHSL-2024-197: Uninitialized variable in gst_matroska_demux_add_wvpk_header leading to function pointer overwriting in GStreamer - CVE-2024-47540

GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gstmatroskademuxaddwvpkheader function within matroska-demux.c. When size < 4, the program calls gstbufferunmap with an uninitialized map variable. Then, in the gstmemoryunmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->memunmapfull or mem->allocator->memunmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.