[FFmpeg-devel] [PR] avcodec/aom_film_grain: avoid duplicate indexes in ff_aom_parse_film_grain_sets() (PR #21660)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21660 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21660
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21660.patch

Fixes: use after free
Fixes: 478301106/clusterfuzz-testcase-minimized-ffmpeg_dem_HEVC_fuzzer-6155792247226368

Found-by:  continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From a55f89710c7c8a812a68a0a2a295452618cfd72d Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 6 Feb 2026 03:27:20 +0100
Subject: [PATCH 1/2] avcodec/aom_film_grain: avoid duplicate indexes in
 ff_aom_parse_film_grain_sets()

Fixes: use after free
Fixes: 478301106/clusterfuzz-testcase-minimized-ffmpeg_dem_HEVC_fuzzer-6155792247226368

Found-by:  continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/aom_film_grain.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavcodec/aom_film_grain.c b/libavcodec/aom_film_grain.c
index a5b692562d..5919d99c30 100644
--- a/libavcodec/aom_film_grain.c
+++ b/libavcodec/aom_film_grain.c
@@ -152,8 +152,9 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s,
         payload_4byte = get_bits1(gb);
         payload_size = get_bits(gb, payload_4byte ? 2 : 8);
         set_idx = get_bits(gb, 3);
+
         fgp = av_film_grain_params_alloc(&fgp_size);
-        if (!fgp)
+        if (!fgp || s->sets[set_idx])
             goto error;
         aom = &fgp->codec.aom;
 
-- 
2.52.0


>From 6efa67d9d448f9a6ae23c5d0c451d058767019f6 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 6 Feb 2026 03:49:30 +0100
Subject: [PATCH 2/2] avcodec/aom_film_grain: Remove impossible check

fgp is freshly allocated so it cannot be equal to ref

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/aom_film_grain.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/aom_film_grain.c b/libavcodec/aom_film_grain.c
index 5919d99c30..bb60c55774 100644
--- a/libavcodec/aom_film_grain.c
+++ b/libavcodec/aom_film_grain.c
@@ -213,7 +213,7 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s,
         }
 
         predict_scaling = get_bits1(gb);
-        if (predict_scaling && (!ref || ref == fgp))
+        if (predict_scaling && !ref)
             goto error; // prediction must be from valid, different set
 
         predict_y_scaling = predict_scaling ? get_bits1(gb) : 0;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org