PR #23708 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23708 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23708.patch
Fixes: out of array read Fixes: oddlist.mov / poc.mov Found-by: Clouditera Security; Z.ai Security; NSFOCUS Signed-off-by: Michael Niedermayer <[email protected]> From 2e5ca6739fe274894a546c10c920c83ff6d44d3a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 5 Jul 2026 22:55:50 +0200 Subject: [PATCH] avcodec/lzf: pad the decompressed buffer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes: out of array read Fixes: oddlist.mov / poc.mov Found-by: Clouditera Security; Z.ai Security; NSFOCUS Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/lzf.c | 12 ++++++++---- libavcodec/lzf.h | 5 +++++ 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/libavcodec/lzf.c b/libavcodec/lzf.c index 5d6e9925d4..1c38c98982 100644 --- a/libavcodec/lzf.c +++ b/libavcodec/lzf.c @@ -32,6 +32,7 @@ #include "libavutil/mem.h" #include "bytestream.h" +#include "defs.h" #include "lzf.h" #define LZF_LITERAL_MAX (1 << 5) @@ -62,8 +63,8 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned if (s < LZF_LITERAL_MAX) { s++; - if (s > *allocated_size - len) { - ret = lzf_realloc(buf, len + s, allocated_size); + if (s + AV_INPUT_BUFFER_PADDING_SIZE > *allocated_size - len) { + ret = lzf_realloc(buf, len + s + AV_INPUT_BUFFER_PADDING_SIZE, allocated_size); if (ret < 0) return ret; p = *buf + len; @@ -87,8 +88,8 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned if (off > len) return AVERROR_INVALIDDATA; - if (l > *allocated_size - len) { - ret = lzf_realloc(buf, len + l, allocated_size); + if (l + AV_INPUT_BUFFER_PADDING_SIZE > *allocated_size - len) { + ret = lzf_realloc(buf, len + l + AV_INPUT_BUFFER_PADDING_SIZE, allocated_size); if (ret < 0) return ret; p = *buf + len; @@ -101,6 +102,9 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned } } + if (*buf) + memset(*buf + len, 0, AV_INPUT_BUFFER_PADDING_SIZE); + *size = len; return 0; diff --git a/libavcodec/lzf.h b/libavcodec/lzf.h index e61ebff727..48f99a452c 100644 --- a/libavcodec/lzf.h +++ b/libavcodec/lzf.h @@ -24,6 +24,11 @@ #include "bytestream.h" +/** + * Decompress LZF data into *buf, reallocating it as needed. + * On success the output is followed by AV_INPUT_BUFFER_PADDING_SIZE + * zeroed bytes. + */ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned *allocated_size); #endif /* AVCODEC_LZF_H */ -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
