From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 751AB4D44F for ; Thu, 25 Dec 2025 21:04:25 +0000 (UTC) Authentication-Results: ffbox; dkim=fail (body hash mismatch (got b'zQtM4rjL9+gdvPcr7/osjla6/Wv4Vx0AhcJ1AHT0s4k=', expected b'XQUYKFFQUCYgBkzH+SsFi3dndnJrMHKof9G8XAq7v1k=')) header.d=ffmpeg.org header.i=@ffmpeg.org header.a=rsa-sha256 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1766696651; h=mime-version : to : date : message-id : reply-to : subject : list-id : list-archive : list-archive : list-help : list-owner : list-post : list-subscribe : list-unsubscribe : from : cc : content-type : content-transfer-encoding : from; bh=zQtM4rjL9+gdvPcr7/osjla6/Wv4Vx0AhcJ1AHT0s4k=; b=Abp1FXDSWkibW0LZUILgeR1eID/eB78XSD7mAZMRJ/+cCm9+9uV+hkMsWeEKvf6R39Mqp vXh8qKoaIlpnI+O+6bE3zcWootAMYAFIPKmlG31XXY0R8xBBZ24hvhuZcliwDgMumwz2V2v pIbpsm0MtojszBRJ89M88V6hVOuLtMZ2icTFSsuMVpfoAs45e0zX3f1upd3ZMbg7JUDyruI 1uqpk836eEG7Xkz3EWMsfkN1Gt8CFsEyMW2OoSNyWJZx0Q1hqxQcL6j6v/h5JyE9FrL/XpC ATZeF/CLHEyRTX3IeXtFSKeIU34gx2LBvJnFcB46oMc6ekNXwnppNmUI+uyw== Received: from [172.20.0.4] (unknown [172.20.0.4]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id D5B0C690B2B; Thu, 25 Dec 2025 23:04:11 +0200 (EET) ARC-Seal: i=1; cv=none; a=rsa-sha256; d=ffmpeg.org; s=arc; t=1766696635; b=XT6UCeU2g3doTmmNqx9gdmGFfFqk4h3x7/y2k/c+hrjdzDqZx3SlCVMAmM/4qCK+sTQuq S/wIU7np06SVqVnSP4RYVOGD5zDNb2UEhGvLMTmznZgwOoSMJ1uFJL5uSD6TTFqsuYof0qp zPPzDqLdE/UycIqxwdfd/Wj+cqE5yI1DcicfyS9HKPM/Na6pnLIl/JsjVnkK2RfoBHFcPYr veA4ROS8S9cMYeHHDGl3NjYEcjmcr7SCJTnptpWuzYRnGJxQSU/3aXPHvhIRpy36A42NXfA G1AjMlvNU3pG/LVFvHycAHadFf6JjNfyUgRBQEVJ/k3MaTf9/3zkkVjxNuqA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=ffmpeg.org; s=arc; t=1766696635; h=from : sender : reply-to : subject : date : message-id : to : cc : mime-version : content-type : content-transfer-encoding : content-id : content-description : resent-date : resent-from : resent-sender : resent-to : resent-cc : resent-message-id : in-reply-to : references : list-id : list-help : list-unsubscribe : list-subscribe : list-post : list-owner : list-archive; bh=YAkK8E6t5uz1uj1yazG9Rg+Ju2Suolf5BgR/70x41x4=; b=jZ2K8sMoo9jYsQjtciTxV2zDMljyyCUsCUicu51DeHfKvjycGVhGWQVyflaF7VIZXbzq0 WrtQtq23XBLc0TgPW7MHDJOdvqV5lWm664n+MGIEkwgMq0dYXWg8UwGwvL7mEUcmeLKik67 27ID51zaicz4U5y4vXHLFGlH4f46p1sDqW0P2nR1rc7vwInqLyODgqDFDfTxe7gIhW8Vzeb cMDOTPRy32OI+MCfaTBjB39dDehP/2TtMfTbHpxznlKsCP8Q7Y3P7dMrMIIVjHLKodS4Eqz 0ZqrVD9bMPGTLi0hpQfeV5YP9hfxLLfye4rsWcYwJAOSLLqPFRNbkcx+180g== ARC-Authentication-Results: i=1; ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none; dmarc=pass header.from=ffmpeg.org policy.dmarc=quarantine Authentication-Results: ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none (Message is not ARC signed); dmarc=pass (Used From Domain Record) header.from=ffmpeg.org policy.dmarc=quarantine DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1766696627; h=content-type : mime-version : content-transfer-encoding : from : to : reply-to : subject : date : from; bh=XQUYKFFQUCYgBkzH+SsFi3dndnJrMHKof9G8XAq7v1k=; b=uBrKnggZFuIWkHVRFqEKy8X8IaY/2tn4Ywl3MdZpTI0xBQ7+s12EHF/6gv25N9hRJpasT DdareorCw9mwUoV4DwhXwNavU2kCgdEazQTlX0LlEBYMi8I7KVrS3TWja4KOJ7t7W4jwPIG F0YEEIgpaMWtl9XjTMMbjVPlVbSb9wP6E5yQlcPR4xR9Jb1bgYHc7LLTdv6EnQtA27wlBQc RiXjn8nfYx4AuBS/HAwLasiYMgzJvIv5Hey7PBZXD0derrCSquW7H7WOyFBQXqOBp+WEQqk IpJ8cG8dTCtLInoYP+FlJRcNp42ba833hYwSKOwVJhCzGqYZsLZQbjZGD7FQ== Received: from 55ca25703178 (code.ffmpeg.org [188.245.149.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 25D6A68F13D for ; Thu, 25 Dec 2025 23:03:47 +0200 (EET) MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Date: Thu, 25 Dec 2025 21:03:46 -0000 Message-ID: <176669662733.25.16116936208754115103@4457048688e7> Message-ID-Hash: PW7D3KMHDOHQUNS6PCW5TQXAYMJXHHRB X-Message-ID-Hash: PW7D3KMHDOHQUNS6PCW5TQXAYMJXHHRB X-MailFrom: code@ffmpeg.org X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-ffmpeg-devel.ffmpeg.org-0; header-match-ffmpeg-devel.ffmpeg.org-1; header-match-ffmpeg-devel.ffmpeg.org-2; header-match-ffmpeg-devel.ffmpeg.org-3; emergency; member-moderation X-Mailman-Version: 3.3.10 Precedence: list Reply-To: FFmpeg development discussions and patches Subject: [FFmpeg-devel] [PATCH] avcodec/exif.c: avoid buffer overflow with extra IFDs (PR #21299) List-Id: FFmpeg development discussions and patches Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Leo Izen via ffmpeg-devel Cc: Leo Izen Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Archived-At: List-Archive: List-Post: PR #21299 opened by Leo Izen (Traneptora) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21299 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21299.patch Maliciously constructed input EXIF blocks could use the extra IFDs we set aside in noncontinugous ways, which will cause them to be written as subdirectories of IFD0 rather than existing IFDs. The base tag size is (correctly) excluded from the size calculation, but if they are being written as additional tags, the allocation will be too small and a write may overflow. Signed-off-by: Leo Izen >>From 9febe411cff9d280ec316008bb616ba971311fdb Mon Sep 17 00:00:00 2001 From: Leo Izen Date: Thu, 25 Dec 2025 15:49:05 -0500 Subject: [PATCH] avcodec/exif.c: avoid buffer overflow with extra IFDs Maliciously constructed input EXIF blocks could use the extra IFDs we set aside in noncontinugous ways, which will cause them to be written as subdirectories of IFD0 rather than existing IFDs. The base tag size is (correctly) excluded from the size calculation, but if they are being written as additional tags, the allocation will be too small and a write may overflow. Signed-off-by: Leo Izen --- libavcodec/exif.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/libavcodec/exif.c b/libavcodec/exif.c index 0de543e35a..5ce402784c 100644 --- a/libavcodec/exif.c +++ b/libavcodec/exif.c @@ -798,13 +798,15 @@ int av_exif_write(void *logctx, const AVExifMetadata *ifd, AVBufferRef **buffer, tput32(&pb, le, 8); } - int extras; - for (extras = 0; extras < FF_ARRAY_ELEMS(extra_ifds); extras++) { + int extras = 0; + for (int i = 0; i < FF_ARRAY_ELEMS(extra_ifds); i++) { AVExifEntry *extra_entry = NULL; - uint16_t extra_tag = 0xFFFCu - extras; + uint16_t extra_tag = 0xFFFCu - i; ret = av_exif_get_entry(logctx, (AVExifMetadata *) ifd, extra_tag, 0, &extra_entry); - if (ret <= 0) + if (ret < 0) break; + if (!ret) + continue; av_log(logctx, AV_LOG_DEBUG, "found extra IFD tag: %04x\n", extra_tag); if (!ifd_new) { ifd_new = av_exif_clone_ifd(ifd); @@ -816,7 +818,7 @@ int av_exif_write(void *logctx, const AVExifMetadata *ifd, AVBufferRef **buffer, AVExifMetadata *cloned = av_exif_clone_ifd(&extra_entry->value.ifd); if (!cloned) break; - extra_ifds[extras] = *cloned; + extra_ifds[extras++] = *cloned; /* don't use av_exif_free here, we want to preserve internals */ av_free(cloned); ret = av_exif_remove_entry(logctx, ifd_new, extra_tag, 0); @@ -824,12 +826,16 @@ int av_exif_write(void *logctx, const AVExifMetadata *ifd, AVBufferRef **buffer, break; } + if (ret < 0) { + av_log(logctx, AV_LOG_ERROR, "error popping additional IFD: %s\n", av_err2str(ret)); + goto end; + } + next = bytestream2_tell_p(&pb); ret = exif_write_ifd(logctx, &pb, le, 0, ifd); if (ret < 0) { - av_buffer_unref(&buf); av_log(logctx, AV_LOG_ERROR, "error writing EXIF data: %s\n", av_err2str(ret)); - return ret; + goto end; } next += ret; @@ -840,8 +846,10 @@ int av_exif_write(void *logctx, const AVExifMetadata *ifd, AVBufferRef **buffer, tput32(&pb, le, next); bytestream2_seek_p(&pb, next, SEEK_SET); ret = exif_write_ifd(logctx, &pb, le, 0, &extra_ifds[i]); - if (ret < 0) - break; + if (ret < 0) { + av_log(logctx, AV_LOG_ERROR, "error writing additional IFD: %s\n", av_err2str(ret)); + goto end; + } next += ret; } @@ -853,6 +861,8 @@ end: av_freep(&ifd_new); for (int i = 0; i < FF_ARRAY_ELEMS(extra_ifds); i++) av_exif_free(&extra_ifds[i]); + if (ret < 0) + av_buffer_unref(&buf); return ret; } -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org