CVE-2024-47834: GHSL-2024-280: Use-After-Free read in Matroska CodecPrivate in GStreamer - CVE-2024-47834

GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GSTMATROSKAIDCODECPRIVATE case within the gstmatroskademuxparsestream function, a data chunk is allocated using gstebmlreadbinary. Later, the allocated memory is freed in the gstmatroskatrackfree function, by the call to gfree (track->codecpriv). Finally, the freed memory is accessed in the capsserialize function through gstvalueserializebuffer. The freed memory will be accessed in the gstvalueserializebuffer function. This results in a UAF read vulnerability, as the function tries to process memory that has already been freed. This vulnerability is fixed in 1.24.10.