[FFmpeg-devel] [PATCH] avcodec/dpx: Fix heap-buffer-overflow in 16-bit decoding (PR #21106)

[oliverchang via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21106 opened by oliverchang
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21106
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21106.patch

Fixes a heap-buffer-overflow in `libavcodec/dpx.c` triggered by a stale
`unpadded_10bit` flag in the `DPXDecContext`. This flag, set for 10-bit
unpadded frames, persisted across `decode_frame` calls. If a subsequent
frame was 16-bit, the stale flag caused incorrect buffer size
validation, allowing truncated buffers to pass checks designed for
smaller 10-bit packed data. This led to an out-of-bounds read in
`av_image_copy_plane` during 16-bit decoding.

The fix explicitly resets `dpx->unpadded_10bit = 0` at the start of
`decode_frame` to ensure correct validation for each frame.

Fixes: https://issues.oss-fuzz.com/issues/464471792


>From 4154373156a9798bbbe632fc1318efb256792816 Mon Sep 17 00:00:00 2001
From: Oliver Chang <ochang@google.com>
Date: Fri, 5 Dec 2025 02:07:10 +0000
Subject: [PATCH] avcodec/dpx: Fix heap-buffer-overflow in 16-bit decoding

Fixes a heap-buffer-overflow in `libavcodec/dpx.c` triggered by a stale
`unpadded_10bit` flag in the `DPXDecContext`. This flag, set for 10-bit
unpadded frames, persisted across `decode_frame` calls. If a subsequent
frame was 16-bit, the stale flag caused incorrect buffer size
validation, allowing truncated buffers to pass checks designed for
smaller 10-bit packed data. This led to an out-of-bounds read in
`av_image_copy_plane` during 16-bit decoding.

The fix explicitly resets `dpx->unpadded_10bit = 0` at the start of
`decode_frame` to ensure correct validation for each frame.

Fixes: https://issues.oss-fuzz.com/issues/464471792
---
 libavcodec/dpx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/dpx.c b/libavcodec/dpx.c
index 7355b50f7a..429290aede 100644
--- a/libavcodec/dpx.c
+++ b/libavcodec/dpx.c
@@ -280,6 +280,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *p,
                         int *got_frame, AVPacket *avpkt)
 {
     DPXDecContext *dpx = avctx->priv_data;
+    dpx->unpadded_10bit = 0;
 
     enum AVPixelFormat pix_fmt;
     const uint8_t *buf = avpkt->data;
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org