From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 80C914DB3F for ; Wed, 31 Dec 2025 02:56:23 +0000 (UTC) Authentication-Results: ffbox; dkim=fail (body hash mismatch (got b'1Xkj1BMxI9dXaJiwHc+lVcSUSRd5FhZopA5dZfw/1w4=', expected b'hgDdPL6glu1qv4/zTtlMXKBwEWQbAyLIRid6Lq3yEzI=')) header.d=ffmpeg.org header.i=@ffmpeg.org header.a=rsa-sha256 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1767149773; h=mime-version : to : date : message-id : reply-to : subject : list-id : list-archive : list-archive : list-help : list-owner : list-post : list-subscribe : list-unsubscribe : from : cc : content-type : content-transfer-encoding : from; bh=1Xkj1BMxI9dXaJiwHc+lVcSUSRd5FhZopA5dZfw/1w4=; b=VWI1/dYVHi+9WnNLVx7TNn1cyylA3hyZlWPrHTXJouT19M8aiR6oQ3rhmzY7V7FDFrypH OkritIxzlgvoO7HwrTXhRFv8wI3tDZee9rmjwp/s7AJOSaXcGeBphNfcI9XhR+XXYci2IjY 3tQKHhuTILdaF/9PZb/e/k1MeX4HhDKbxdLKwZP51YuWm9UOUDkJGudolgwabonJxMkFIUg Igjq0E+MEhvMMf5zXi2P3q+EV5MYJSPXoFKmSgWF+al5XaktH29jfoDJtCYtLbXdu+YfICb wT/2+6nVia9a9IYkc+rB3mES/a48m9jhYNTC/ruepkLpnMEWH/7TyOEj1EHg== Received: from [172.20.0.4] (unknown [172.20.0.4]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id D6941690BFF; Wed, 31 Dec 2025 04:56:13 +0200 (EET) ARC-Seal: i=1; cv=none; a=rsa-sha256; d=ffmpeg.org; s=arc; t=1767149757; b=bLw5aUSYR5HbUcAsCky3sfpbos5Y9ZpfqwxcCI4Q1bU7mkiUZT/5NRVgGVWNGhOm14Pfx f8mDdIrI4ELJZtY1STXbf4Hrm96rSbAUQJEzrx0lOhiiHssSLf9nOIZwZANRJf3qqY3wiD4 IJD+D3aMhBl6VWqPHxo4DDZ83R7mNm7/IIl7oZPP6yk6FZ1No3BVDdJNt2+L79jrFGS6w+s qTTW7kKjx+ggz9ILia29BetJLhiEMgSXU0C+wKZukMrFvtu0WLmVF+r8SywPx/a5nxxvgVY HeM8b3sQTZ/9cfsvjfoXdS8JuJhJnI+4XzOUSs7p4Cf78OmEHxysSS3SGq8Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=ffmpeg.org; s=arc; t=1767149757; h=from : sender : reply-to : subject : date : message-id : to : cc : mime-version : content-type : content-transfer-encoding : content-id : content-description : resent-date : resent-from : resent-sender : resent-to : resent-cc : resent-message-id : in-reply-to : references : list-id : list-help : list-unsubscribe : list-subscribe : list-post : list-owner : list-archive; bh=ZoVSMXf4cp+DhAqJ0f9SkUsQMfadXSZ3RBysejVVHos=; b=aOg++7jL8o3/t15GgvTSuNgA9ljZH2F1PJiojP7UgSOc7qYTwoTcCHisOxofLv6U3y/vS MUgfjnfySEWU8EcdXklQIKEEw39y8IVYaA667VmSfIH1Vl5JsCnMzFlDguROaB0LCbD6O9r QNmgFgOVLwDKoR48wh+q0X+kwyaevSCpkgDG21n/AlRnUjMJqSp4GXXNUdpXlks2n8Lclqp DuVr5CgpDOyLfhADJEP1zjCW4q16NxfteGDJeqLUlR8ABpzoJNqIbPLpvoEvQmvYzMD+2QG sLP+DbbvGTzj9lFmHodwoQyjmTjEHwL7JtEiGPZ3/tc3E4KngFf6RAF373Rw== ARC-Authentication-Results: i=1; ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none; dmarc=pass header.from=ffmpeg.org policy.dmarc=quarantine Authentication-Results: ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none (Message is not ARC signed); dmarc=pass (Used From Domain Record) header.from=ffmpeg.org policy.dmarc=quarantine DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1767149749; h=content-type : mime-version : content-transfer-encoding : from : to : reply-to : subject : date : from; bh=hgDdPL6glu1qv4/zTtlMXKBwEWQbAyLIRid6Lq3yEzI=; b=2uibCEpSBOhip98vvrQ5sf1LGQ1ZN0knDhTd4gdTvti0p7WB3ye67XV5nOVqENz8N8z9i 782neRb8JN+KAaggk0JXUg3nheapo7e/2BfA3xL3B4ns8KL7/e/n2o2ubf7v4l11s7li0EC HklBmQMEmKCc5KFaQRBLm15rsm/956Pa9vbt41O2h0emK2PVoqmmg+97ZHs4+YUnJZUe/Rc /hQi88nEtMbohr67YSJzs/Qvy2xGUsfQel1t989F+nbkSb5h4anmm6StVRBglRV+X+2uvjl wE4QrtKdEIEFQWTjs/KcAlB6LTHSYgOS//Zvhdemh2NMLgDiINxcYqRY2aiw== Received: from de3a2b3407a2 (code.ffmpeg.org [188.245.149.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 96487690B58 for ; Wed, 31 Dec 2025 04:55:49 +0200 (EET) MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Date: Wed, 31 Dec 2025 02:55:49 -0000 Message-ID: <176714974978.25.975860886018665805@4457048688e7> Message-ID-Hash: 67EVCZ3LPCHQDB2RLLZBGIA4YFPTD5VN X-Message-ID-Hash: 67EVCZ3LPCHQDB2RLLZBGIA4YFPTD5VN X-MailFrom: code@ffmpeg.org X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-ffmpeg-devel.ffmpeg.org-0; header-match-ffmpeg-devel.ffmpeg.org-1; header-match-ffmpeg-devel.ffmpeg.org-2; header-match-ffmpeg-devel.ffmpeg.org-3; emergency; member-moderation X-Mailman-Version: 3.3.10 Precedence: list Reply-To: FFmpeg development discussions and patches Subject: [FFmpeg-devel] [PR] avformat/img2dec: reject input images too big to fit into a single packet (PR #21334) List-Id: FFmpeg development discussions and patches Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Timo Rothenpieler via ffmpeg-devel Cc: Timo Rothenpieler Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Archived-At: List-Archive: List-Post: PR #21334 opened by Timo Rothenpieler (BtbN) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21334 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21334.patch Not entirely sure if it should instead use some entirely different approach here, given that images exceeding 2GB don't seem that crazy to me, but so far processing such images results in a heap overflow, since the size addition overflows and a much too small packet is allocated and its size never checked again when writing into it. Fixes #YWH-PGM40646-32 >>From adebaa447e94078d17e44cefe3ade507d6c5b0f2 Mon Sep 17 00:00:00 2001 From: Timo Rothenpieler Date: Wed, 31 Dec 2025 03:41:21 +0100 Subject: [PATCH] avformat/img2dec: reject input images too big to fit into a single packet Not entirely sure if it should instead use some entirely different approach here, given that images exceeding 2GB don't seem that crazy to me, but so far processing such images results in a heap overflow, since the size addition overflows and a much too small packet is allocated and its size never checked again when writing into it. Fixes #YWH-PGM40646-32 --- libavformat/img2dec.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c index 8f1c9013ca..9c2c519e4f 100644 --- a/libavformat/img2dec.c +++ b/libavformat/img2dec.c @@ -365,8 +365,10 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) VideoDemuxData *s = s1->priv_data; AVBPrint filename; int i, res; - int size[3] = { 0 }, ret[3] = { 0 }; - AVIOContext *f[3] = { NULL }; + int ret[3] = { 0 }; + int64_t size[3] = { 0 }; + int64_t total_size; + AVIOContext *f[3] = { NULL }; AVCodecParameters *par = s1->streams[0]->codecpar; av_bprint_init(&filename, 0, AV_BPRINT_SIZE_UNLIMITED); @@ -456,7 +458,11 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) } } - res = av_new_packet(pkt, size[0] + size[1] + size[2]); + total_size = size[0] + size[1] + size[2]; + if (total_size < 0 || total_size > INT_MAX || size[0] > INT_MAX || size[1] > INT_MAX || size[2] > INT_MAX) + return AVERROR_INVALIDDATA; + + res = av_new_packet(pkt, total_size); if (res < 0) { goto fail; } -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org