PR #24913 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24913 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24913.patch
Since 74f470c05c a line ends with two 0x00 bytes before the 0xf0, so the worst case line needs 4 bytes besides the pixel codes, not 3. Fixes: out of array write Fixes: RzTpnrDqkaCQ Out of array write Replicated through API with ASAN Found during triage of the security report IRdTPagGrTLk >From 0290e098137b4cf00e802fb598355d58ee3fce5e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 06:49:22 +0200 Subject: [PATCH 1/2] avcodec/dvbsubenc: Account for the full CLUT segment header Fixes: out of array write Fixes: IRdTPagGrTLk Heap out of array write Replicated through UnModified FFmpeg with ASAN Found-by: Secbuddy, Tencent Keen Security Lab --- libavcodec/dvbsubenc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/dvbsubenc.c b/libavcodec/dvbsubenc.c index 6f42b1f134..c9ff94c2c0 100644 --- a/libavcodec/dvbsubenc.c +++ b/libavcodec/dvbsubenc.c @@ -360,7 +360,7 @@ static int dvbsub_encode(AVCodecContext *avctx, uint8_t *outbuf, int buf_size, return AVERROR(EINVAL); } - if (buf_size < 6 + h->rects[clut_id]->nb_colors * 6) + if (buf_size < 8 + h->rects[clut_id]->nb_colors * 6) return AVERROR_BUFFER_TOO_SMALL; /* CLUT segment */ @@ -391,7 +391,7 @@ static int dvbsub_encode(AVCodecContext *avctx, uint8_t *outbuf, int buf_size, } bytestream_put_be16(&pseg_len, q - pseg_len - 2); - buf_size -= 6 + h->rects[clut_id]->nb_colors * 6; + buf_size -= 8 + h->rects[clut_id]->nb_colors * 6; } if (buf_size < h->num_rects * 22) -- 2.52.0 >From 7d3aabe251732177293154aa02f18a2511829e80 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 06:49:45 +0200 Subject: [PATCH 2/2] avcodec/dvbsubenc: Reserve 4 bytes of line overhead in dvb_encode_rle8() Since 74f470c05c a line ends with two 0x00 bytes before the 0xf0, so the worst case line needs 4 bytes besides the pixel codes, not 3. Fixes: out of array write Fixes: RzTpnrDqkaCQ Out of array write Replicated through API with ASAN Found during triage of the security report IRdTPagGrTLk --- libavcodec/dvbsubenc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/dvbsubenc.c b/libavcodec/dvbsubenc.c index c9ff94c2c0..b6e31ab933 100644 --- a/libavcodec/dvbsubenc.c +++ b/libavcodec/dvbsubenc.c @@ -221,8 +221,8 @@ static int dvb_encode_rle8(uint8_t **pq, int buf_size, q = *pq; for (y = 0; y < h; y++) { - // Worst case line is 12 bits per value, + 3 bytes overhead - if (buf_size * 8 < w * 12 + 24) + // Worst case line is 12 bits per value, + 4 bytes overhead + if (buf_size * 8 < w * 12 + 32) return AVERROR_BUFFER_TOO_SMALL; line_begin = q; *q++ = 0x12; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
