iDEFENSE Security Advisory 12.21.2004-1 – Remote exploitation of a buffer overflow in version 0.99.2 of xine could allow execution of arbitrary code. The vulnerability specifically exists in the RMF_TAG, DATA_TAG, PROP_TAG, MDPR_TAG and CONT_TAG handling code of the pnm_get_chunk() function. These tags are all handled by the same code. The code does not perform correct checking on the chunk size before reading data in. If the size given is less than the PREAMBLE_SIZE, a negative length read is made into a fixed length buffer. Because the read length parameter is an unsigned value, the negative length is interpreted as a very large length, allowing a buffer overflow to occur.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/35475/12.21.04-1.txt
Source: https://packetstormsecurity.com/files/35475/iDEFENSE-Security-Advisory-2004-12-21.1.html