PR #21660 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21660 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21660.patch
Fixes: use after free Fixes: 478301106/clusterfuzz-testcase-minimized-ffmpeg_dem_HEVC_fuzzer-6155792247226368 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> >From a55f89710c7c8a812a68a0a2a295452618cfd72d Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 6 Feb 2026 03:27:20 +0100 Subject: [PATCH 1/2] avcodec/aom_film_grain: avoid duplicate indexes in ff_aom_parse_film_grain_sets() Fixes: use after free Fixes: 478301106/clusterfuzz-testcase-minimized-ffmpeg_dem_HEVC_fuzzer-6155792247226368 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/aom_film_grain.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/aom_film_grain.c b/libavcodec/aom_film_grain.c index a5b692562d..5919d99c30 100644 --- a/libavcodec/aom_film_grain.c +++ b/libavcodec/aom_film_grain.c @@ -152,8 +152,9 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s, payload_4byte = get_bits1(gb); payload_size = get_bits(gb, payload_4byte ? 2 : 8); set_idx = get_bits(gb, 3); + fgp = av_film_grain_params_alloc(&fgp_size); - if (!fgp) + if (!fgp || s->sets[set_idx]) goto error; aom = &fgp->codec.aom; -- 2.52.0 >From 6efa67d9d448f9a6ae23c5d0c451d058767019f6 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 6 Feb 2026 03:49:30 +0100 Subject: [PATCH 2/2] avcodec/aom_film_grain: Remove impossible check fgp is freshly allocated so it cannot be equal to ref Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/aom_film_grain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/aom_film_grain.c b/libavcodec/aom_film_grain.c index 5919d99c30..bb60c55774 100644 --- a/libavcodec/aom_film_grain.c +++ b/libavcodec/aom_film_grain.c @@ -213,7 +213,7 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s, } predict_scaling = get_bits1(gb); - if (predict_scaling && (!ref || ref == fgp)) + if (predict_scaling && !ref) goto error; // prediction must be from valid, different set predict_y_scaling = predict_scaling ? get_bits1(gb) : 0; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
