[FFmpeg-devel] [PATCH] ff-tmp-exif-clear (PR #20513)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #20513 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20513
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20513.patch

avcodec/exif: Use av_fast_mallocz() in av_exif_clone_ifd()

using fast realloc leaves the entries uninitialized and frees garbage pointers on
errors



>From f4cfb976540b4eaed69873b6168ebc331b8923b2 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 13 Sep 2025 13:53:53 +0200
Subject: [PATCH 1/2] avcodec/exif: Do not leave uninitialized pointers on
 errors in exif_clone_entry()

No testcase, but this looks like it could free garbage pointers

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/exif.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/exif.c b/libavcodec/exif.c
index f9ad3e1bdb..3e86833986 100644
--- a/libavcodec/exif.c
+++ b/libavcodec/exif.c
@@ -953,6 +953,7 @@ static int exif_clone_entry(AVExifEntry *dst, const AVExifEntry *src)
     dst->count = src->count;
     dst->id = src->id;
     dst->type = src->type;
+    memset(&dst->value, 0, sizeof(dst->value));
 
     dst->ifd_offset = src->ifd_offset;
     if (src->ifd_lead) {
-- 
2.49.1


>From 2e8cc7b86019fb32bdf0b23a138901e6f65238f5 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 13 Sep 2025 14:00:55 +0200
Subject: [PATCH 2/2] avcodec/exif: Use av_fast_mallocz() in
 av_exif_clone_ifd()

using fast realloc leaves the entries uninitialized and frees garbage pointers on
errors

Fixes: bug_triggering_file

Found-by: *2ourc3, 5pider
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/exif.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/exif.c b/libavcodec/exif.c
index 3e86833986..cd6c0c3771 100644
--- a/libavcodec/exif.c
+++ b/libavcodec/exif.c
@@ -1152,7 +1152,7 @@ AVExifMetadata *av_exif_clone_ifd(const AVExifMetadata *ifd)
         size_t required_size;
         if (av_size_mult(ret->count, sizeof(*ret->entries), &required_size) < 0)
             goto fail;
-        ret->entries = av_fast_realloc(NULL, &ret->size, required_size);
+        av_fast_mallocz(&ret->entries, &ret->size, required_size);
         if (!ret->entries)
             goto fail;
     }
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org