The avi_read_header function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to memory leak when decoding an AVI file that has a crafted strh structure. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-7555