PR #23822 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23822 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23822.patch
parse_dat(), parse_cube(), and parse_cinespace() multiply an untrusted LUT size before allocate_3dlut() validates it, which can overflow int. Use the validated lutsize2 computed by allocate_3dlut() instead. Fixes: signed integer overflow >From 95797e89acc48b7eb6b8b535325ec60c7523aee0 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 10 Jul 2026 04:07:17 +0200 Subject: [PATCH] avfilter/vf_lut3d: do not compute size*size before the size is validated parse_dat(), parse_cube(), and parse_cinespace() multiply an untrusted LUT size before allocate_3dlut() validates it, which can overflow int. Use the validated lutsize2 computed by allocate_3dlut() instead. Fixes: signed integer overflow --- libavfilter/vf_lut3d.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavfilter/vf_lut3d.c b/libavfilter/vf_lut3d.c index 9071dabeb9..2c78507b7e 100644 --- a/libavfilter/vf_lut3d.c +++ b/libavfilter/vf_lut3d.c @@ -651,11 +651,11 @@ static int parse_dat(AVFilterContext *ctx, FILE *f) NEXT_LINE(skip_line(line)); } - size2 = size * size; ret = allocate_3dlut(ctx, size, 0); if (ret < 0) return ret; + size2 = lut3d->lutsize2; for (k = 0; k < size; k++) { for (j = 0; j < size; j++) { @@ -681,13 +681,13 @@ static int parse_cube(AVFilterContext *ctx, FILE *f) while (fgets(line, sizeof(line), f)) { if (!strncmp(line, "LUT_3D_SIZE", 11)) { - int ret, i, j, k; + int ret, i, j, k, size2; const int size = strtol(line + 12, NULL, 0); - const int size2 = size * size; ret = allocate_3dlut(ctx, size, 0); if (ret < 0) return ret; + size2 = lut3d->lutsize2; for (k = 0; k < size; k++) { for (j = 0; j < size; j++) { @@ -999,7 +999,6 @@ static int parse_cinespace(AVFilterContext *ctx, FILE *f) } size = size_r; - size2 = size * size; if (prelut_sizes[0] && prelut_sizes[1] && prelut_sizes[2]) prelut = 1; @@ -1007,6 +1006,7 @@ static int parse_cinespace(AVFilterContext *ctx, FILE *f) ret = allocate_3dlut(ctx, size, prelut); if (ret < 0) goto end; + size2 = lut3d->lutsize2; for (int k = 0; k < size; k++) { for (int j = 0; j < size; j++) { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
