PR #24755 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24755 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24755.patch
Fixes: heap-use-after-free Fixes: GXcHU0CpqXBk Fixes: ANT-2026-5PRHEUWY Found-by: Anthropic agents; validated and reported by Ada Logics. >From 3897a97e8b48b23da82eeda8263a8f2f7063fd81 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 25 Sep 2026 05:30:54 +0200 Subject: [PATCH 1/2] avformat/iamf_parse: drop the parameter definitions registered by a rejected OBU Fixes: heap-use-after-free Fixes: GXcHU0CpqXBk Fixes: ANT-2026-5PRHEUWY Found-by: Anthropic agents; validated and reported by Ada Logics. --- libavformat/iamf_parse.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 892145cd87..1ae76e54a1 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -746,6 +746,12 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb, return 0; } +static void drop_param_definitions(IAMFContext *c, int nb_kept) +{ + while (c->nb_param_definitions > nb_kept) + av_freep(&c->param_definitions[--c->nb_param_definitions]); +} + static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) { const IAMFCodecConfig *codec_config; @@ -755,7 +761,7 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) AVIOContext *pbc; uint8_t *buf; unsigned audio_element_id, nb_substreams, codec_config_id, num_parameters; - int audio_element_type, ret; + int audio_element_type, ret, nb_param_definitions = c->nb_param_definitions; buf = av_malloc(len); if (!buf) @@ -936,8 +942,10 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) ret = 0; fail: av_free(buf); - if (ret < 0) + if (ret < 0) { ff_iamf_free_audio_element(&audio_element); + drop_param_definitions(c, nb_param_definitions); + } return ret; } @@ -967,7 +975,7 @@ static int mix_presentation_obu(void *s, IAMFContext *c, AVIOContext *pb, int le AVIOContext *pbc; uint8_t *buf; unsigned nb_submixes, mix_presentation_id; - int ret; + int ret, nb_param_definitions = c->nb_param_definitions; buf = av_malloc(len); if (!buf) @@ -1199,8 +1207,10 @@ static int mix_presentation_obu(void *s, IAMFContext *c, AVIOContext *pb, int le ret = 0; fail: av_free(buf); - if (ret < 0) + if (ret < 0) { ff_iamf_free_mix_presentation(&mix_presentation); + drop_param_definitions(c, nb_param_definitions); + } return ret; } -- 2.52.0 >From e7331c37f432928e67c6887ddb212df540625e2b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 25 Sep 2026 05:31:21 +0200 Subject: [PATCH 2/2] avformat/mov: release the IAMF context when the iacb descriptors are rejected This is hardening. The security report GXcHU0CpqXBk (ANT-2026-5PRHEUWY) identified this as the condition that made the dangling registry entries fixed in the previous commit reachable from a fragmented mp4. Found-by: Anthropic agents; validated and reported by Ada Logics. --- libavformat/mov.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 24b178649a..6fc6d91768 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -961,8 +961,11 @@ static int mov_read_iacb(MOVContext *c, AVIOContext *pb, MOVAtom atom) descriptor_pb = &b.pub; ret = ff_iamfdec_read_descriptors(iamf, descriptor_pb, descriptors_size, c->fc); - if (ret < 0) + if (ret < 0) { + ff_iamf_read_deinit(sc->iamf); + av_freep(&sc->iamf); return ret; + } metadata = st->metadata; st->metadata = NULL; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
