From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 0992F4CAB6 for ; Thu, 7 Aug 2025 18:43:42 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 12C3468D164; Thu, 7 Aug 2025 21:43:38 +0300 (EEST) Received: from 0f9ae49ae7c8 (code.ffmpeg.org [188.245.149.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 58EC468CB22 for ; Thu, 7 Aug 2025 21:43:36 +0300 (EEST) MIME-Version: 1.0 From: michaelni To: ffmpeg-devel@ffmpeg.org Subject: [FFmpeg-devel] =?utf-8?q?=5BPATCH=5D_fix_2_vulnerabilities_repor?= =?utf-8?q?ted_by_ossuzz_=28PR_=2320163=29?= X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Message-Id: <20250807184338.12C3468D164@ffbox0-bg.ffmpeg.org> Date: Thu, 7 Aug 2025 21:43:38 +0300 (EEST) Archived-At: List-Archive: List-Post: PR #20163 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20163 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20163.patch >From 0829dc148e00077acdb448f8f123d61a74202f9c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 7 Aug 2025 19:38:30 +0200 Subject: [PATCH 1/2] avcodec/sanm: Check mv in codec48_block() Fixes: out of array read Fixes: 436943287/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5011037029203968 This issue did oddly enough, not replicate Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/sanm.c | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c index d345f58846..a066a864eb 100644 --- a/libavcodec/sanm.c +++ b/libavcodec/sanm.c @@ -1427,8 +1427,18 @@ static void c48_4to8(uint8_t *dst, const uint8_t *src, const uint16_t w) } } -static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db, - const uint16_t w) +static int check_mv(int x, int y, const uint16_t w, int h, int blocksize, int mvofs) { + if (mvofs < -x + -y*w) + return AVERROR_INVALIDDATA; + + if (mvofs > w-x-blocksize + w*(h-y-blocksize)) + return AVERROR_INVALIDDATA; + + return 0; +} + +static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db, int x, int y, + const uint16_t w, int h) { uint8_t opc, sb[16]; int i, j, k, l; @@ -1453,6 +1463,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db, if (bytestream2_get_bytes_left(&ctx->gb) < 2) return 1; mvofs = bytestream2_get_le16(&ctx->gb); + if (check_mv(x, y, w, h, 8, mvofs)) + return 1; for (i = 0; i < 8; i++) { ofs = w * i; for (k = 0; k < 8; k++) @@ -1480,6 +1492,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db, for (k = 0; k < 8; k += 4) { opc = bytestream2_get_byteu(&ctx->gb); mvofs = c37_mv[opc * 2] + (c37_mv[opc * 2 + 1] * w); + if (check_mv(x+k, y+i, w, h, 4, mvofs)) + return 1; for (j = 0; j < 4; j++) { ofs = (w * (j + i)) + k; for (l = 0; l < 4; l++) @@ -1494,6 +1508,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db, for (i = 0; i < 8; i += 4) { for (k = 0; k < 8; k += 4) { mvofs = bytestream2_get_le16(&ctx->gb); + if (check_mv(x+k, y+i, w, h, 4, mvofs)) + return 1; for (j = 0; j < 4; j++) { ofs = (w * (j + i)) + k; for (l = 0; l < 4; l++) @@ -1516,6 +1532,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db, ofs = (w * i) + j; opc = bytestream2_get_byteu(&ctx->gb); mvofs = c37_mv[opc * 2] + (c37_mv[opc * 2 + 1] * w); + if (check_mv(x+j, y+i, w, h, 2, mvofs)) + return 1; for (l = 0; l < 2; l++) { *(dst + ofs + l + 0) = *(db + ofs + l + 0 + mvofs); *(dst + ofs + l + w) = *(db + ofs + l + w + mvofs); @@ -1530,6 +1548,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db, for (j = 0; j < 8; j += 2) { ofs = w * i + j; mvofs = bytestream2_get_le16(&ctx->gb); + if (check_mv(x+j, y+i, w, h, 2, mvofs)) + return 1; for (l = 0; l < 2; l++) { *(dst + ofs + l + 0) = *(db + ofs + l + 0 + mvofs); *(dst + ofs + l + w) = *(db + ofs + l + w + mvofs); @@ -1548,6 +1568,8 @@ static int codec48_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *db, break; default: // copy 8x8 block from prev, c37_mv from source mvofs = c37_mv[opc * 2] + (c37_mv[opc * 2 + 1] * w); + if (check_mv(x, y, w, h, 8, mvofs)) + return 1; for (i = 0; i < 8; i++) { ofs = i * w; for (l = 0; l < 8; l++) @@ -1613,7 +1635,7 @@ static int old_codec48(SANMVideoContext *ctx, int width, int height) if (seq == ctx->prev_seq + 1) { for (j = 0; j < height; j += 8) { for (i = 0; i < width; i += 8) { - if (codec48_block(ctx, dst + i, prev + i, width)) + if (codec48_block(ctx, dst + i, prev + i, i, j, width, height)) return AVERROR_INVALIDDATA; } dst += width * 8; -- 2.49.1 >From 9bcd6250889b7044636885152319de028a000a17 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 7 Aug 2025 19:56:53 +0200 Subject: [PATCH 2/2] avcodec/dxv: Use av_fast_realloc() and clear all new space The code writing in the buffer has a wide range of error checks which simply leave it partly uninitialized. Initializing it on allocation ensures no sensitive data leaks and that bugs are more reliably reproduceable Fixes: use of uninitialized memory Fixes: 435225510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-4521918634196992 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/dxv.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c index 0b8e077ad6..7e11bef733 100644 --- a/libavcodec/dxv.c +++ b/libavcodec/dxv.c @@ -38,6 +38,7 @@ typedef struct DXVContext { GetByteContext gbc; uint8_t *tex_data; // Compressed texture + unsigned tex_data_size; uint8_t *ctex_data; // Compressed chroma texture int64_t tex_size; // Texture size @@ -969,9 +970,14 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame, ctx->tex_size = avctx->coded_width / (texdsp_ctx.raw_ratio / (avctx->pix_fmt == AV_PIX_FMT_RGBA ? 4 : 1)) * avctx->coded_height / TEXTURE_BLOCK_H * texdsp_ctx.tex_ratio; - ret = av_reallocp(&ctx->tex_data, ctx->tex_size + AV_INPUT_BUFFER_PADDING_SIZE); - if (ret < 0) - return ret; + unsigned old_size = ctx->tex_data_size; + void *ptr = av_fast_realloc(ctx->tex_data, &ctx->tex_data_size, ctx->tex_size + AV_INPUT_BUFFER_PADDING_SIZE); + if (!ptr) + return AVERROR(ENOMEM); + ctx->tex_data = ptr; + + if (ctx->tex_data_size > old_size) + memset(ctx->tex_data + old_size, 0, ctx->tex_data_size - old_size); if (avctx->pix_fmt != AV_PIX_FMT_RGBA) { int i; @@ -1078,6 +1084,8 @@ static av_cold int dxv_close(AVCodecContext *avctx) DXVContext *ctx = avctx->priv_data; av_freep(&ctx->tex_data); + ctx->tex_data_size = 0; + av_freep(&ctx->ctex_data); av_freep(&ctx->op_data[0]); av_freep(&ctx->op_data[1]); -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".