[FFmpeg-devel] [PATCH] avcodec/adpcm: fix heap-buffer-overflow in IMA MAGIX decoding

[FFmpeg-devel] [PATCH] avcodec/adpcm: fix heap-buffer-overflow in IMA MAGIX decoding

[Ard Biesheuvel via ffmpeg-devel]

From: Ard Biesheuvel <ardb@google.com>

The IMA MAGIX decoder calculates the output buffer size (nb_samples)
based on the actual input packet size (buf_size) via get_nb_samples().
However, the decoding loop previously relied on avctx->block_align to
determine the iteration count.

When block_align is larger than the actual packet size (e.g., a 71-byte
packet with block_align=16384), the loop attempts to process more data
than available. This results in out-of-bounds reads from the input
bytestream and out-of-bounds writes to the allocated output buffer.

Fix this by adding a check for remaining input bytes (>= 8) to the loop
condition, ensuring the loop terminates when the input is exhausted.

oss-fuzz: https://oss-fuzz.com/testcase-detail/4847227777646592
Co-authored-by: CodeMender <codemender-patching@google.com>
Signed-off-by: Ard Biesheuvel <ardb@google.com>
---
 libavcodec/adpcm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c
index bd9ad2933f..2828cb8c31 100644
--- a/libavcodec/adpcm.c
+++ b/libavcodec/adpcm.c
@@ -1799,7 +1799,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, AVFrame *frame,
             }
         }
 
-        for (int m = 0; m < avctx->block_align-8; m += 8) {
+        for (int m = 0; m < avctx->block_align-8 && bytestream2_get_bytes_left(&gb) >= 8; m += 8) {
             uint32_t v0 = bytestream2_get_le32u(&gb);
             uint32_t v1 = bytestream2_get_le32u(&gb);
 
-- 
2.53.0.239.g8d8fc8a987-goog

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org

[FFmpeg-devel] Re: [PATCH] avcodec/adpcm: fix heap-buffer-overflow in IMA MAGIX decoding

[Ard Biesheuvel via ffmpeg-devel]

L.S.,

On Wed, Feb 11, 2026 at 9:28 AM Ard Biesheuvel <ardb+git@google.com> wrote:
>
> From: Ard Biesheuvel <ardb@google.com>
>

This message is a duplicate and may be disregarded - due to poor
coordination between my colleague and myself (mea culpa), we ended up
sending the same patch twice, via different channels.

Please refer to this version instead:
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21730


> The IMA MAGIX decoder calculates the output buffer size (nb_samples)
> based on the actual input packet size (buf_size) via get_nb_samples().
> However, the decoding loop previously relied on avctx->block_align to
> determine the iteration count.
>
> When block_align is larger than the actual packet size (e.g., a 71-byte
> packet with block_align=16384), the loop attempts to process more data
> than available. This results in out-of-bounds reads from the input
> bytestream and out-of-bounds writes to the allocated output buffer.
>
> Fix this by adding a check for remaining input bytes (>= 8) to the loop
> condition, ensuring the loop terminates when the input is exhausted.
>
> oss-fuzz: https://oss-fuzz.com/testcase-detail/4847227777646592
> Co-authored-by: CodeMender <codemender-patching@google.com>
> Signed-off-by: Ard Biesheuvel <ardb@google.com>
> ---
>  libavcodec/adpcm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c
> index bd9ad2933f..2828cb8c31 100644
> --- a/libavcodec/adpcm.c
> +++ b/libavcodec/adpcm.c
> @@ -1799,7 +1799,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, AVFrame *frame,
>              }
>          }
>
> -        for (int m = 0; m < avctx->block_align-8; m += 8) {
> +        for (int m = 0; m < avctx->block_align-8 && bytestream2_get_bytes_left(&gb) >= 8; m += 8) {
>              uint32_t v0 = bytestream2_get_le32u(&gb);
>              uint32_t v1 = bytestream2_get_le32u(&gb);
>
> --
> 2.53.0.239.g8d8fc8a987-goog
>
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org