PR #21730 opened by oliverchang URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21730 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21730.patch
The IMA MAGIX decoder calculates the output buffer size (nb_samples) based on the actual input packet size (buf_size) via get_nb_samples(). However, the decoding loop previously relied on avctx->block_align to determine the iteration count. When block_align is larger than the actual packet size (e.g., a 71-byte packet with block_align=16384), the loop attempts to process more data than available. This results in out-of-bounds reads from the input bytestream and out-of-bounds writes to the allocated output buffer. Fix this by adding a check for remaining input bytes (>= 8) to the loop condition, ensuring the loop terminates when the input is exhausted. Co-authored-by: CodeMender <[email protected]> Signed-off-by: Oliver Chang <[email protected]> Fixes: https://issues.oss-fuzz.com/issues/471509958 >From 84314a6ade2f04954ee6443d62b957ccfddc22c9 Mon Sep 17 00:00:00 2001 From: Oliver Chang <[email protected]> Date: Wed, 11 Feb 2026 03:24:14 +0000 Subject: [PATCH] avcodec/adpcm: fix heap-buffer-overflow in IMA MAGIX decoding The IMA MAGIX decoder calculates the output buffer size (nb_samples) based on the actual input packet size (buf_size) via get_nb_samples(). However, the decoding loop previously relied on avctx->block_align to determine the iteration count. When block_align is larger than the actual packet size (e.g., a 71-byte packet with block_align=16384), the loop attempts to process more data than available. This results in out-of-bounds reads from the input bytestream and out-of-bounds writes to the allocated output buffer. Fix this by adding a check for remaining input bytes (>= 8) to the loop condition, ensuring the loop terminates when the input is exhausted. Co-authored-by: CodeMender <[email protected]> Signed-off-by: Oliver Chang <[email protected]> Fixes: https://issues.oss-fuzz.com/issues/471509958 --- libavcodec/adpcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c index bd9ad2933f..2828cb8c31 100644 --- a/libavcodec/adpcm.c +++ b/libavcodec/adpcm.c @@ -1799,7 +1799,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, AVFrame *frame, } } - for (int m = 0; m < avctx->block_align-8; m += 8) { + for (int m = 0; m < avctx->block_align-8 && bytestream2_get_bytes_left(&gb) >= 8; m += 8) { uint32_t v0 = bytestream2_get_le32u(&gb); uint32_t v1 = bytestream2_get_le32u(&gb); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
