The gif_copy_img_rect function in libavcodec/gifdec.c in FFmpeg before 1.1.2 performs an incorrect calculation for an "end pointer," which allows remote attackers to have an unspecified impact via crafted GIF data that triggers an out-of-bounds array access.
https://security.gentoo.org/glsa/201603-06
http://www.ffmpeg.org/security.html
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=9547034f9120187e23ad76424dd4d70247e62212