[FFmpeg-devel] [PATCH] VMD demuxer: precedence bug makes failed reads look like success (PR #21165)

[ruikai via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21165 opened by ruikai
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21165
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21165.patch

In `libavformat/sierravmd.c (vmd_read_header)`, the header read check was written as:

```
if ((ret = ffio_read_size(pb, vmd->vmd_header, VMD_HEADER_SIZE) < 0))
    return ret;
```

Due to operator precedence, this stores the boolean result of the comparison into ret, so a failed read (negative return) becomes `ret = 1,` which is treated as success. 
`avformat_open_input() `then completes with zero streams and uninitialized state, letting the demuxer proceed into `vmd_read_packet()` with bogus tables.

We have not reported this as a security issue because we did not demonstrate a ground-truth crash in validation, though it has an interesting possibility as an OOB primitive.

Found-by: Pwno


>From d158e8605cdfcdbd973bddbed52fcc511e590a88 Mon Sep 17 00:00:00 2001
From: Ruikai Peng <ruikai@pwno.io>
Date: Thu, 11 Dec 2025 06:27:48 +0000
Subject: [PATCH] VMD demuxer: precedence bug makes failed reads look like
 success

---
 libavformat/sierravmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/sierravmd.c b/libavformat/sierravmd.c
index bb1d1c5df7..2519756533 100644
--- a/libavformat/sierravmd.c
+++ b/libavformat/sierravmd.c
@@ -103,7 +103,7 @@ static int vmd_read_header(AVFormatContext *s)
 
     /* fetch the main header, including the 2 header length bytes */
     avio_seek(pb, 0, SEEK_SET);
-    if ((ret = ffio_read_size(pb, vmd->vmd_header, VMD_HEADER_SIZE) < 0))
+    if ((ret = ffio_read_size(pb, vmd->vmd_header, VMD_HEADER_SIZE)) < 0)
         return ret;
 
     width = AV_RL16(&vmd->vmd_header[12]);
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org