PR #21430 opened by ruikai
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21430
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21430.patch
bl16_decode_1() and bl16_decode_7() uses unchecked
read bytestream2_get_le16u / bytestream2_get_byteu
read but only validate (width*height)/2 or
(width*height)/4 bytes. The actual number of samples
read is hh * hw, where hh = (height + 1) >> 1 and
hw = (width - 1) >> 1.
Fix by checking the actual consumption
(hh * (width - 1) >> 1) * {2, 1} bytes before decoding.
keep hw as is since it's used for the loop condition.
>From 0dccbd100729d2cfbe3f30fe619111adb80e9a87 Mon Sep 17 00:00:00 2001
From: Ruikai Peng <[email protected]>
Date: Sat, 10 Jan 2026 21:03:59 -0500
Subject: [PATCH] avcodec/sanm: fix OOB reads in bl16_decode_1() and
bl16_decode_7()
bl16_decode_1() and bl16_decode_7() uses unchecked
read bytestream2_get_le16u / bytestream2_get_byteu
read but only validate (width*height)/2 or
(width*height)/4 bytes. The actual number of samples
read is hh * hw, where hh = (height + 1) >> 1 and
hw = (width - 1) >> 1.
Fix by checking the actual consumption
(hh * (width - 1) >> 1) * {2, 1} bytes before decoding.
keep hw as is since it's used for the loop condition.
---
libavcodec/sanm.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
index 771ecf8246..dca844a725 100644
--- a/libavcodec/sanm.c
+++ b/libavcodec/sanm.c
@@ -2274,10 +2274,9 @@ static int bl16_decode_1(SANMVideoContext *ctx)
{
uint16_t hh, hw, c1, c2, *dst1, *dst2;
- if (bytestream2_get_bytes_left(&ctx->gb) < ((ctx->width * ctx->height) /
2))
- return AVERROR_INVALIDDATA;
-
hh = (ctx->height + 1) >> 1;
+ if (bytestream2_get_bytes_left(&ctx->gb) < 2 * hh * ((ctx->width - 1) >>
1))
+ return AVERROR_INVALIDDATA;
dst1 = (uint16_t *)ctx->frm0 + ctx->pitch; /* start with line 1 */
while (hh--) {
hw = (ctx->width - 1) >> 1;
@@ -2601,10 +2600,9 @@ static int bl16_decode_7(SANMVideoContext *ctx)
{
uint16_t hh, hw, c1, c2, *dst1, *dst2;
- if (bytestream2_get_bytes_left(&ctx->gb) < ((ctx->width * ctx->height) /
4))
- return AVERROR_INVALIDDATA;
-
hh = (ctx->height + 1) >> 1;
+ if (bytestream2_get_bytes_left(&ctx->gb) < hh * ((ctx->width - 1) >> 1))
+ return AVERROR_INVALIDDATA;
dst1 = (uint16_t *)ctx->frm0 + ctx->pitch; /* start with line 1 */
while (hh--) {
hw = (ctx->width - 1) >> 1;
--
2.49.1
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
