[FFmpeg-devel] [PR] avcodec/exr: enforce maximum channel limit to avoid excessive memory allocations (PR #21347)

[Timo Rothenpieler via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21347 opened by Timo Rothenpieler (BtbN)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21347
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21347.patch

A specially crafted file could define an unlimited number of channels,
leading to ever-growing memory allocations and even overflows in the
size calculation.

Also fixes the not properly checked allocation via av_realloc.

Fixes #YWH-PGM40646-33


>From 025e88a32c87eaf3e6f912ed51521d020a9a85b2 Mon Sep 17 00:00:00 2001
From: Timo Rothenpieler <timo@rothenpieler.org>
Date: Wed, 31 Dec 2025 22:02:34 +0100
Subject: [PATCH 1/2] avcodec/exr: only assign result of av_realloc on
 allocation success

---
 libavcodec/exr.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index 536a55c5be..8b9fe4b3fc 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -1603,6 +1603,7 @@ static int decode_header(EXRContext *s, AVFrame *frame)
     int layer_match = 0;
     int ret;
     int dup_channels = 0;
+    void *tmp;
 
     s->current_channel_offset = 0;
     s->xmin               = ~0;
@@ -1807,12 +1808,13 @@ static int decode_header(EXRContext *s, AVFrame *frame)
                     }
                 }
 
-                s->channels = av_realloc(s->channels,
-                                         ++s->nb_channels * sizeof(EXRChannel));
-                if (!s->channels) {
+                tmp = av_realloc(s->channels, ++s->nb_channels * sizeof(EXRChannel));
+                if (!tmp) {
                     ret = AVERROR(ENOMEM);
                     goto fail;
                 }
+                s->channels = tmp;
+
                 channel             = &s->channels[s->nb_channels - 1];
                 channel->pixel_type = current_pixel_type;
                 channel->xsub       = xsub;
-- 
2.49.1


>From c97c5fa2f3598c14858ec6fb357537ae4fe1c36b Mon Sep 17 00:00:00 2001
From: Timo Rothenpieler <timo@rothenpieler.org>
Date: Wed, 31 Dec 2025 22:02:52 +0100
Subject: [PATCH 2/2] avcodec/exr: enforce maximum channel limit to avoid
 excessive memory allocations

A specially crafted file could define an unlimited number of channels,
leading to ever growing memory allocations and even overflows in the
size calculation.

Fixes #YWH-PGM40646-33
---
 libavcodec/exr.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index 8b9fe4b3fc..10078b462f 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -59,6 +59,8 @@
 #include "mathops.h"
 #include "thread.h"
 
+#define MAX_CHANNELS 1024
+
 enum ExrCompr {
     EXR_RAW,
     EXR_RLE,
@@ -1808,6 +1810,12 @@ static int decode_header(EXRContext *s, AVFrame *frame)
                     }
                 }
 
+                if (s->nb_channels >= MAX_CHANNELS) {
+                    av_log(s->avctx, AV_LOG_ERROR, "Number of channels exceeds supported maximum of %d.\n", MAX_CHANNELS);
+                    ret = AVERROR_INVALIDDATA;
+                    goto fail;
+                }
+
                 tmp = av_realloc(s->channels, ++s->nb_channels * sizeof(EXRChannel));
                 if (!tmp) {
                     ret = AVERROR(ENOMEM);
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org