This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit ac507eac6382f49e89e67748a76c8ba7f86bc52f Author: Michael Niedermayer <[email protected]> AuthorDate: Sun Jul 5 22:55:50 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue Jul 21 22:59:55 2026 +0200 avcodec/lzf: pad the decompressed buffer Fixes: out of array read Fixes: oddlist.mov / poc.mov Found-by: Clouditera Security; Z.ai Security; NSFOCUS Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit fe47696aa1eb3b4f2359b9c4416c529912deee38) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/lzf.c | 12 ++++++++---- libavcodec/lzf.h | 5 +++++ 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/libavcodec/lzf.c b/libavcodec/lzf.c index 5d6e9925d4..1c38c98982 100644 --- a/libavcodec/lzf.c +++ b/libavcodec/lzf.c @@ -32,6 +32,7 @@ #include "libavutil/mem.h" #include "bytestream.h" +#include "defs.h" #include "lzf.h" #define LZF_LITERAL_MAX (1 << 5) @@ -62,8 +63,8 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned if (s < LZF_LITERAL_MAX) { s++; - if (s > *allocated_size - len) { - ret = lzf_realloc(buf, len + s, allocated_size); + if (s + AV_INPUT_BUFFER_PADDING_SIZE > *allocated_size - len) { + ret = lzf_realloc(buf, len + s + AV_INPUT_BUFFER_PADDING_SIZE, allocated_size); if (ret < 0) return ret; p = *buf + len; @@ -87,8 +88,8 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned if (off > len) return AVERROR_INVALIDDATA; - if (l > *allocated_size - len) { - ret = lzf_realloc(buf, len + l, allocated_size); + if (l + AV_INPUT_BUFFER_PADDING_SIZE > *allocated_size - len) { + ret = lzf_realloc(buf, len + l + AV_INPUT_BUFFER_PADDING_SIZE, allocated_size); if (ret < 0) return ret; p = *buf + len; @@ -101,6 +102,9 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned } } + if (*buf) + memset(*buf + len, 0, AV_INPUT_BUFFER_PADDING_SIZE); + *size = len; return 0; diff --git a/libavcodec/lzf.h b/libavcodec/lzf.h index e61ebff727..48f99a452c 100644 --- a/libavcodec/lzf.h +++ b/libavcodec/lzf.h @@ -24,6 +24,11 @@ #include "bytestream.h" +/** + * Decompress LZF data into *buf, reallocating it as needed. + * On success the output is followed by AV_INPUT_BUFFER_PADDING_SIZE + * zeroed bytes. + */ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned *allocated_size); #endif /* AVCODEC_LZF_H */ _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
