[FFmpeg-devel] [PATCH] avcodec/vlc: fix heap use after free

* [FFmpeg-devel] [PATCH] avcodec/vlc: fix heap use after free
@ 2023-09-26  7:47 Paul B Mahol
  2023-09-26  9:28 ` Andreas Rheinhardt
  0 siblings, 1 reply; 2+ messages in thread
From: Paul B Mahol @ 2023-09-26  7:47 UTC (permalink / raw)
  To: FFmpeg development discussions and patches

[-- Attachment #1: Type: text/plain, Size: 10 bytes --]

Attached.

[-- Attachment #2: 0001-avcodec-vlc-fix-heap-use-after-free.patch --]
[-- Type: text/x-patch, Size: 3168 bytes --]

From d0b6b08b38e5f4314f046118bff70d1e08b46bbf Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Tue, 26 Sep 2023 09:37:12 +0200
Subject: [PATCH] avcodec/vlc: fix heap use after free

Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
 libavcodec/vlc.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/libavcodec/vlc.c b/libavcodec/vlc.c
index 3b66c94354..2b7535c2ce 100644
--- a/libavcodec/vlc.c
+++ b/libavcodec/vlc.c
@@ -237,8 +237,6 @@ static int vlc_common_end(VLC *vlc, int nb_bits, int nb_codes, VLCcode *codes,
             av_log(NULL, AV_LOG_ERROR, "needed %d had %d\n", vlc->table_size, vlc->table_allocated);
         av_assert0(ret >= 0);
     } else {
-        if (codes != localbuf)
-            av_free(codes);
         if (ret < 0) {
             av_freep(&vlc->table);
             return ret;
@@ -299,8 +297,11 @@ int ff_vlc_init_sparse(VLC *vlc, int nb_bits, int nb_codes,
     COPY(len && len <= nb_bits);
     nb_codes = j;
 
-    return vlc_common_end(vlc, nb_bits, nb_codes, buf,
+    ret = vlc_common_end(vlc, nb_bits, nb_codes, buf,
                           flags, localbuf);
+    if (buf != localbuf)
+        av_free(buf);
+    return ret;
 }
 
 int ff_vlc_init_from_lengths(VLC *vlc, int nb_bits, int nb_codes,
@@ -335,19 +336,21 @@ int ff_vlc_init_from_lengths(VLC *vlc, int nb_bits, int nb_codes,
             continue;
         if (len > len_max || code & ((1U << (32 - len)) - 1)) {
             av_log(logctx, AV_LOG_ERROR, "Invalid VLC (length %u)\n", len);
+            ret = AVERROR_INVALIDDATA;
             goto fail;
         }
         code += 1U << (32 - len);
         if (code > UINT32_MAX + 1ULL) {
             av_log(logctx, AV_LOG_ERROR, "Overdetermined VLC tree\n");
+            ret = AVERROR_INVALIDDATA;
             goto fail;
         }
     }
-    return vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf);
+    ret = vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf);
 fail:
     if (buf != localbuf)
         av_free(buf);
-    return AVERROR_INVALIDDATA;
+    return ret;
 }
 
 static void add_level(VLC_MULTI_ELEM *table, const int nb_elems,
@@ -463,22 +466,24 @@ int ff_vlc_init_multi_from_lengths(VLC *vlc, VLC_MULTI *multi, int nb_bits, int
             continue;
         if (len > len_max || code & ((1U << (32 - len)) - 1)) {
             av_log(logctx, AV_LOG_ERROR, "Invalid VLC (length %u)\n", len);
+            ret = AVERROR_INVALIDDATA;
             goto fail;
         }
         code += 1U << (32 - len);
         if (code > UINT32_MAX + 1ULL) {
             av_log(logctx, AV_LOG_ERROR, "Overdetermined VLC tree\n");
+            ret = AVERROR_INVALIDDATA;
             goto fail;
         }
     }
     ret = vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf);
     if (ret < 0)
         goto fail;
-    return vlc_multi_gen(multi->table, vlc, nb_elems, j, nb_bits, buf, logctx);
+    ret = vlc_multi_gen(multi->table, vlc, nb_elems, j, nb_bits, buf, logctx);
 fail:
     if (buf != localbuf)
         av_free(buf);
-    return AVERROR_INVALIDDATA;
+    return ret;
 }
 
 void ff_vlc_free_multi(VLC_MULTI *vlc)
-- 
2.42.0


[-- Attachment #3: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 2+ messages in thread