[FFmpeg-devel] [PATCH] avcodec/prores_raw: Fix heap buffer overflow (PR #20245)

[Marvin Scholz <code@ffmpeg.org>]

PR #20245 opened by Marvin Scholz (ePirat)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20245
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20245.patch

When dimensions differ from context, those were updated using
ff_set_dimensions, however this overwrote the aligned coded_width and
coded_height that were set before, leading to a buffer overflow when
writing the frame data.

Fixes: OssFuzz 438771336
Fixes: Heap-buffer-overflow

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Marvin Scholz <epirat07@gmail.com>
Reviewed-by: Marvin Scholz <epirat07@gmail.com>


From 9a6fc04013e0913830e9f1cf513977cfe10f49d7 Mon Sep 17 00:00:00 2001
From: Oliver Chang <ochang@google.com>
Date: Thu, 14 Aug 2025 22:11:41 -0700
Subject: [PATCH] avcodec/prores_raw: Fix heap buffer overflow

When dimensions differ from context, those were updated using
ff_set_dimensions, however this overwrote the aligned coded_width and
coded_height that were set before, leading to a buffer overflow when
writing the frame data.

Fixes: OssFuzz 438771336
Fixes: Heap-buffer-overflow

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Marvin Scholz <epirat07@gmail.com>
Reviewed-by: Marvin Scholz <epirat07@gmail.com>
---
 libavcodec/prores_raw.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/prores_raw.c b/libavcodec/prores_raw.c
index 748e176815..b2aa97ddda 100644
--- a/libavcodec/prores_raw.c
+++ b/libavcodec/prores_raw.c
@@ -367,9 +367,6 @@ static int decode_frame(AVCodecContext *avctx,
     if ((w & 1) || (h & 1))
         return AVERROR_INVALIDDATA;
 
-    avctx->coded_width  = FFALIGN(w, 16);
-    avctx->coded_height = FFALIGN(h, 16);
-
     if (w != avctx->width || h != avctx->height) {
         av_log(avctx, AV_LOG_WARNING, "picture resolution change: %ix%i -> %ix%i\n",
                avctx->width, avctx->height, w, h);
@@ -377,6 +374,9 @@ static int decode_frame(AVCodecContext *avctx,
             return ret;
     }
 
+    avctx->coded_width  = FFALIGN(w, 16);
+    avctx->coded_height = FFALIGN(h, 16);
+
     enum AVPixelFormat pix_fmt = AV_PIX_FMT_BAYER_RGGB16;
     if (pix_fmt != s->pix_fmt) {
         s->pix_fmt = pix_fmt;
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".