[FFmpeg-devel] [PR] avcodec/sanm: fix OOB reads in bl16_decode_1() and bl16_decode_7() (PR #21430)

[ruikai via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21430 opened by ruikai
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21430
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21430.patch

bl16_decode_1() and bl16_decode_7() uses unchecked
read bytestream2_get_le16u / bytestream2_get_byteu
read but only validate (width*height)/2 or
(width*height)/4 bytes. The actual number of samples
read is hh * hw, where hh = (height + 1) >> 1 and
hw = (width - 1) >> 1.

Fix by checking the actual consumption
(hh * (width - 1) >> 1) * {2, 1} bytes before decoding.
keep hw as is since it's used for the loop condition.


>From 0dccbd100729d2cfbe3f30fe619111adb80e9a87 Mon Sep 17 00:00:00 2001
From: Ruikai Peng <ruikai@pwno.io>
Date: Sat, 10 Jan 2026 21:03:59 -0500
Subject: [PATCH] avcodec/sanm: fix OOB reads in bl16_decode_1() and
 bl16_decode_7()

bl16_decode_1() and bl16_decode_7() uses unchecked
read bytestream2_get_le16u / bytestream2_get_byteu
read but only validate (width*height)/2 or
(width*height)/4 bytes. The actual number of samples
read is hh * hw, where hh = (height + 1) >> 1 and
hw = (width - 1) >> 1.

Fix by checking the actual consumption
(hh * (width - 1) >> 1) * {2, 1} bytes before decoding.
keep hw as is since it's used for the loop condition.
---
 libavcodec/sanm.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
index 771ecf8246..dca844a725 100644
--- a/libavcodec/sanm.c
+++ b/libavcodec/sanm.c
@@ -2274,10 +2274,9 @@ static int bl16_decode_1(SANMVideoContext *ctx)
 {
     uint16_t hh, hw, c1, c2, *dst1, *dst2;
 
-    if (bytestream2_get_bytes_left(&ctx->gb) < ((ctx->width * ctx->height) / 2))
-        return AVERROR_INVALIDDATA;
-
     hh = (ctx->height + 1) >> 1;
+    if (bytestream2_get_bytes_left(&ctx->gb) < 2 * hh * ((ctx->width - 1) >> 1))
+        return AVERROR_INVALIDDATA;
     dst1 = (uint16_t *)ctx->frm0 + ctx->pitch;    /* start with line 1 */
     while (hh--) {
         hw = (ctx->width - 1) >> 1;
@@ -2601,10 +2600,9 @@ static int bl16_decode_7(SANMVideoContext *ctx)
 {
     uint16_t hh, hw, c1, c2, *dst1, *dst2;
 
-    if (bytestream2_get_bytes_left(&ctx->gb) < ((ctx->width * ctx->height) / 4))
-        return AVERROR_INVALIDDATA;
-
     hh = (ctx->height + 1) >> 1;
+    if (bytestream2_get_bytes_left(&ctx->gb) < hh * ((ctx->width - 1) >> 1))
+        return AVERROR_INVALIDDATA;
     dst1 = (uint16_t *)ctx->frm0 + ctx->pitch;    /* start with line 1 */
     while (hh--) {
         hw = (ctx->width - 1) >> 1;
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org