See how l-smash compares to other vendors in security performance
L-SMASH through 2.14.5 contains a double free vulnerability in hevcsetupfirstsummary() and h264setupfirstsummary() in importer/naluimp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmashreadfile() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.
L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1importerprobe() in importer/vc1imp.c that allows attackers to hang applications via crafted input files. Attackers can supply a file consisting only of zero bytes, which lsmashreadfile() probes automatically, causing indefinite CPU consumption and denial of service.