[FFmpeg-devel] [PATCH] avcodec/hevc/sei: prevent storing a potentially bogus num_ref_displays value in HEVCSEITDRDI (PR #20676)

[James Almer via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #20676 opened by James Almer (jamrial)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20676
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20676.patch

Supersedes PR #20675


>From 47473414c5a3329308ce6f0f31947b891ff58156 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Thu, 9 Oct 2025 00:31:10 -0300
Subject: [PATCH 1/3] avcodec/hevc/sei: prevent storing a potentially bogus
 num_ref_displays value in HEVCSEITDRDI

Fixes: 439711052/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4956250308935680
Fixes: out of array access

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavcodec/hevc/sei.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/libavcodec/hevc/sei.c b/libavcodec/hevc/sei.c
index b8e98cde89..e81dfcbff9 100644
--- a/libavcodec/hevc/sei.c
+++ b/libavcodec/hevc/sei.c
@@ -167,6 +167,8 @@ static int decode_nal_sei_timecode(HEVCSEITimeCode *s, GetBitContext *gb)
 
 static int decode_nal_sei_3d_reference_displays_info(HEVCSEITDRDI *s, GetBitContext *gb)
 {
+    unsigned num_ref_displays;
+
     s->prec_ref_display_width = get_ue_golomb(gb);
     if (s->prec_ref_display_width > 31)
         return AVERROR_INVALIDDATA;
@@ -176,10 +178,10 @@ static int decode_nal_sei_3d_reference_displays_info(HEVCSEITDRDI *s, GetBitCont
         if (s->prec_ref_viewing_dist > 31)
             return AVERROR_INVALIDDATA;
     }
-    s->num_ref_displays = get_ue_golomb(gb);
-    if (s->num_ref_displays > 31)
+    num_ref_displays = get_ue_golomb(gb);
+    if (num_ref_displays > 31)
         return AVERROR_INVALIDDATA;
-    s->num_ref_displays += 1;
+    s->num_ref_displays = num_ref_displays + 1;
 
     for (int i = 0; i < s->num_ref_displays; i++) {
         int length;
-- 
2.49.1


>From 13b9ed162f8ab749ab3b5b7cb214c7bdf6299188 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Thu, 9 Oct 2025 00:31:57 -0300
Subject: [PATCH 2/3] avcodec/hevc/sei: don't attempt to use stale values in
 HEVCSEITDRDI

Invalidate the whole struct on SEI reset.

Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavcodec/hevc/hevcdec.c | 2 +-
 libavcodec/hevc/sei.c     | 2 ++
 libavcodec/hevc/sei.h     | 2 ++
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
index b27d1d79e8..8d432a9a1f 100644
--- a/libavcodec/hevc/hevcdec.c
+++ b/libavcodec/hevc/hevcdec.c
@@ -4106,7 +4106,7 @@ static int hevc_sei_to_context(AVCodecContext *avctx, HEVCSEI *sei)
 {
     int ret;
 
-    if (sei->tdrdi.num_ref_displays) {
+    if (sei->tdrdi.present) {
         AVBufferRef *buf;
         size_t size;
         AV3DReferenceDisplaysInfo *tdrdi = av_tdrdi_alloc(sei->tdrdi.num_ref_displays, &size);
diff --git a/libavcodec/hevc/sei.c b/libavcodec/hevc/sei.c
index e81dfcbff9..5fd4e763b3 100644
--- a/libavcodec/hevc/sei.c
+++ b/libavcodec/hevc/sei.c
@@ -217,6 +217,8 @@ static int decode_nal_sei_3d_reference_displays_info(HEVCSEITDRDI *s, GetBitCont
     }
     s->three_dimensional_reference_displays_extension_flag = get_bits1(gb);
 
+    s->present = 1;
+
     return 0;
 }
 
diff --git a/libavcodec/hevc/sei.h b/libavcodec/hevc/sei.h
index c4714bb7c5..d6891d60a6 100644
--- a/libavcodec/hevc/sei.h
+++ b/libavcodec/hevc/sei.h
@@ -93,6 +93,7 @@ typedef struct HEVCSEITDRDI {
     uint8_t additional_shift_present_flag[32];
     int16_t num_sample_shift[32];
     uint8_t three_dimensional_reference_displays_extension_flag;
+    int present;
 } HEVCSEITDRDI;
 
 typedef struct HEVCSEIRecoveryPoint {
@@ -126,6 +127,7 @@ int ff_hevc_decode_nal_sei(GetBitContext *gb, void *logctx, HEVCSEI *s,
  */
 static inline void ff_hevc_reset_sei(HEVCSEI *sei)
 {
+    sei->tdrdi.present = 0;
     ff_h2645_sei_reset(&sei->common);
 }
 
-- 
2.49.1


>From d224576dac12dfa88ca001eb466c3bda23806f1f Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Thu, 9 Oct 2025 00:32:39 -0300
Subject: [PATCH 3/3] avcodec/hevc/sei: don't attempt to use stale values in
 HEVCSEITimeCode

Invalidate the whole struct on SEI reset.

Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavcodec/hevc/sei.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/hevc/sei.h b/libavcodec/hevc/sei.h
index d6891d60a6..2fcd0e8d57 100644
--- a/libavcodec/hevc/sei.h
+++ b/libavcodec/hevc/sei.h
@@ -127,6 +127,7 @@ int ff_hevc_decode_nal_sei(GetBitContext *gb, void *logctx, HEVCSEI *s,
  */
 static inline void ff_hevc_reset_sei(HEVCSEI *sei)
 {
+    sei->timecode.present = 0;
     sei->tdrdi.present = 0;
     ff_h2645_sei_reset(&sei->common);
 }
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org