PR #21352 opened by ruikai URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21352 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21352.patch
Synthetic extra IFD tags (0xFFED..0xFFFC) are reserved and should not be treated as IFDs when they come from input. Refuse to parse them as IFDs and only peel entries that are real IFDs, This fixes a heap OOB when synthetic tags are nested and sized without the 12 bytes directory slot but survived peeling. >From 64924fb88b77a962f0cd6c21d4b82cc164c391f4 Mon Sep 17 00:00:00 2001 From: retr0reg <[email protected]> Date: Thu, 1 Jan 2026 16:55:46 -0500 Subject: [PATCH] avcodec/exif.c: ignore synthetic tags as IFDs Synthetic extra IFD tags (0xFFED..0xFFFC) are reserved and should not be treated as IFDs when they come from input. Refuse to parse them as IFDs and only peel entries that are real IFDs, This fixes a heap OOB when synthetic tags are nested and sized without the 12 bytes directory slot but survived peeling. --- libavcodec/exif.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/libavcodec/exif.c b/libavcodec/exif.c index 5ce402784c..775fe1a983 100644 --- a/libavcodec/exif.c +++ b/libavcodec/exif.c @@ -230,6 +230,11 @@ static const size_t exif_sizes[] = { [AV_TIFF_IFD] = 4, }; +static av_always_inline int exif_is_synthetic_tag(uint16_t id) +{ + return id > 0xFFECu && id <= 0xFFFCu; +} + const char *av_exif_get_tag_name(uint16_t id) { for (size_t i = 0; i < FF_ARRAY_ELEMS(tag_list); i++) { @@ -498,7 +503,8 @@ static int exif_decode_tag(void *logctx, GetByteContext *gb, int le, if (type > AV_TIFF_IFD || count >= INT_MAX/8U) return AVERROR_INVALIDDATA; - is_ifd = type == AV_TIFF_IFD || ff_tis_ifd(entry->id) || entry->id == MAKERNOTE_TAG; + is_ifd = (type == AV_TIFF_IFD || ff_tis_ifd(entry->id) || entry->id == MAKERNOTE_TAG) && + !exif_is_synthetic_tag(entry->id); if (is_ifd) { if (!payload) @@ -805,6 +811,8 @@ int av_exif_write(void *logctx, const AVExifMetadata *ifd, AVBufferRef **buffer, ret = av_exif_get_entry(logctx, (AVExifMetadata *) ifd, extra_tag, 0, &extra_entry); if (ret < 0) break; + if (extra_entry->type != AV_TIFF_IFD) + continue; if (!ret) continue; av_log(logctx, AV_LOG_DEBUG, "found extra IFD tag: %04x\n", extra_tag); -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
