PR #24914 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24914 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24914.patch
Found-by: Joshua Rogers <[email protected]> >From fd8f85062ac74f0801f6cbb76d82ebe619c986d2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 02:51:51 +0200 Subject: [PATCH 1/9] avformat/vpk: Reject a last block that is not a whole number of channels Fixes: use of uninitialized memory Fixes: ApyrsACJSltE Fixes: AISLE-2026-0111-00564 Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind Found-by: Joshua Rogers <[email protected]> --- libavformat/vpk.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/vpk.c b/libavformat/vpk.c index 172e45d7da..442c856650 100644 --- a/libavformat/vpk.c +++ b/libavformat/vpk.c @@ -92,6 +92,11 @@ static int vpk_read_packet(AVFormatContext *s, AVPacket *pkt) if (par->ch_layout.nb_channels <= 0) return AVERROR_INVALIDDATA; + if (vpk->last_block_size % par->ch_layout.nb_channels) { + avpriv_request_sample(s, "last block size %u for %d channels", + vpk->last_block_size, par->ch_layout.nb_channels); + return AVERROR_PATCHWELCOME; + } size = vpk->last_block_size / par->ch_layout.nb_channels; skip = (par->block_align - vpk->last_block_size) / par->ch_layout.nb_channels; pos = avio_tell(s->pb); -- 2.52.0 >From 52f2f3217f0a2d57cec79b280d7f172e65699d14 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 06:50:59 +0200 Subject: [PATCH 2/9] avformat/mxg: Fail on truncated marker segments Fixes: use of uninitialized memory Fixes: 544YKgP8DNSj Fixes: AISLE-2026-0111-00027 Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind Found-by: Joshua Rogers <[email protected]> --- libavformat/mxg.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/mxg.c b/libavformat/mxg.c index 40139d7d3d..5595d7d270 100644 --- a/libavformat/mxg.c +++ b/libavformat/mxg.c @@ -203,6 +203,8 @@ static int mxg_read_packet(AVFormatContext *s, AVPacket *pkt) ret = mxg_update_cache(s, size); if (ret < 0) return ret; + if (mxg->cache_size < size) + return AVERROR_EOF; startmarker_ptr = mxg->buffer_ptr - 2; mxg->cache_size = 0; } else { -- 2.52.0 >From b31940d7a37bb4cfe7d7e5346f027b78bfe8c255 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 06:51:31 +0200 Subject: [PATCH 3/9] avformat/iff: Check the DPEL color format read size Fixes: use of uninitialized memory Fixes: fo0u77U9tJ8g Fixes: AISLE-2026-0111-00464 Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind Found-by: Joshua Rogers <[email protected]> --- libavformat/iff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/iff.c b/libavformat/iff.c index df926cb59a..a8c10f6286 100644 --- a/libavformat/iff.c +++ b/libavformat/iff.c @@ -613,7 +613,7 @@ static int iff_read_header(AVFormatContext *s) return AVERROR_INVALIDDATA; if (!stv) return AVERROR_INVALIDDATA; - if ((fmt_size = avio_read(pb, fmt, sizeof(fmt))) < 0) + if ((fmt_size = ffio_read_size(pb, fmt, sizeof(fmt))) < 0) return fmt_size; if (fmt_size == sizeof(deep_rgb24) && !memcmp(fmt, deep_rgb24, sizeof(deep_rgb24))) stv->codecpar->format = AV_PIX_FMT_RGB24; -- 2.52.0 >From 7922c3b8bc707d1dbf1ebfdcd13433a3b530fa1d Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 06:51:47 +0200 Subject: [PATCH 4/9] avformat/omadec: Repeat the key bytes from the padded key copy in kset() Fixes: out of array read Fixes: f3cEzuDEDwTL Fixes: AISLE-2026-0111-00258 Out of array read Replicated through UnModified FFmpeg with ASAN Found-by: Joshua Rogers <[email protected]> --- libavformat/omadec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/omadec.c b/libavformat/omadec.c index 552a37df18..6c034b1a1a 100644 --- a/libavformat/omadec.c +++ b/libavformat/omadec.c @@ -126,14 +126,14 @@ static int kset(AVFormatContext *s, const uint8_t *r_val, const uint8_t *n_val, memset(oc->r_val, 0, 24); memcpy(oc->r_val, r_val, len); } - memcpy(&oc->r_val[16], r_val, 8); + memcpy(&oc->r_val[16], oc->r_val, 8); } if (n_val) { if (n_val != oc->n_val) { memset(oc->n_val, 0, 24); memcpy(oc->n_val, n_val, len); } - memcpy(&oc->n_val[16], n_val, 8); + memcpy(&oc->n_val[16], oc->n_val, 8); } return 0; -- 2.52.0 >From 41fadc4f444a8be19f16665449270a3f54fc9aca Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 06:52:22 +0200 Subject: [PATCH 5/9] avformat/libmodplug: Allocate the buffer for the bytes that are read Fixes: out of array write Fixes: QDheAEkG6X39 Fixes: AISLE-2026-0111-00036 Out of array write Replicated through UnModified FFmpeg with ASAN Found-by: Joshua Rogers <[email protected]> --- libavformat/libmodplug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/libmodplug.c b/libavformat/libmodplug.c index 01566d121e..d9ab14b3bc 100644 --- a/libavformat/libmodplug.c +++ b/libavformat/libmodplug.c @@ -197,7 +197,7 @@ static int modplug_read_header(AVFormatContext *s) return r; } - modplug->buf = av_malloc(modplug->max_size); + modplug->buf = av_malloc(sz); if (!modplug->buf) return AVERROR(ENOMEM); sz = avio_read(pb, modplug->buf, sz); -- 2.52.0 >From a66e06b13e610948d8935b25d94da8619d56b184 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 06:52:48 +0200 Subject: [PATCH 6/9] avformat/dvdvideodec: Check the menu audio stream count The title path rejects more than 8 audio streams, the menu path did not, Fixes: out of array read Fixes: q4AeKlitZZgH Fixes: AISLE-2026-0111-00216 Out of array read Replicated through UnModified FFmpeg with ASAN Found-by: Joshua Rogers <[email protected]> --- libavformat/dvdvideodec.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 544206c67b..cf4c7962df 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -252,6 +252,13 @@ static int dvdvideo_ifo_open(AVFormatContext *s) return AVERROR_EXTERNAL; } + if ((!c->opt_menu_vts && c->vmg_ifo->vmgi_mat->nr_of_vmgm_audio_streams > 8) || + ( c->opt_menu_vts && c->vts_ifo->vtsi_mat->nr_of_vtsm_audio_streams > 8)) { + av_log(s, AV_LOG_ERROR, "Menu has invalid headers (too many audio streams)\n"); + + return AVERROR_INVALIDDATA; + } + return 0; } -- 2.52.0 >From 6bbf9b047cb8db080ad73fec7a99f479d7b528f0 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:14:20 +0200 Subject: [PATCH 7/9] avformat/nistspheredec: Fix the check of ff_alloc_extradata() Fixes: use of uninitialized memory Fixes: kgMrew6pYynv Fixes: AISLE-2026-0111-00062 Use of uninitialized memory Replicated through UnModified FFmpeg (ffprobe) with Valgrind Found-by: Joshua Rogers <[email protected]> --- libavformat/nistspheredec.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libavformat/nistspheredec.c b/libavformat/nistspheredec.c index e624036149..df58017236 100644 --- a/libavformat/nistspheredec.c +++ b/libavformat/nistspheredec.c @@ -36,7 +36,7 @@ static int nist_probe(const AVProbeData *p) static int nist_read_header(AVFormatContext *s) { char buffer[256]= {0}, coding[32] = "pcm", format[32] = "01"; - int bps = 0, be = 0; + int bps = 0, be = 0, ret; int32_t header_size = -1; AVStream *st; @@ -73,8 +73,10 @@ static int nist_read_header(AVFormatContext *s) st->codecpar->codec_id = AV_CODEC_ID_PCM_MULAW; } else if (!av_strncasecmp(coding, "pcm,embedded-shorten", 20)) { st->codecpar->codec_id = AV_CODEC_ID_SHORTEN; - if (ff_alloc_extradata(st->codecpar, 1)) - st->codecpar->extradata[0] = 1; + ret = ff_alloc_extradata(st->codecpar, 1); + if (ret < 0) + return ret; + st->codecpar->extradata[0] = 1; } else { avpriv_request_sample(s, "coding %s", coding); } -- 2.52.0 >From 4fee57f185f1629dd7e4382cb72699e79bd857ea Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:16:13 +0200 Subject: [PATCH 8/9] avformat/sierravmd: Do not return the unwritten record space of Indeo3 frames Fixes: use of uninitialized memory Fixes: TlRax2lAwSba Fixes: AISLE-2026-0111-00077 Use of uninitialized memory Replicated through UnModified FFmpeg (ffprobe) with Valgrind Found-by: Joshua Rogers <[email protected]> --- libavformat/sierravmd.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavformat/sierravmd.c b/libavformat/sierravmd.c index a86b0a1603..f9a4c40445 100644 --- a/libavformat/sierravmd.c +++ b/libavformat/sierravmd.c @@ -289,9 +289,10 @@ static int vmd_read_packet(AVFormatContext *s, return ret; pkt->pos= avio_tell(pb); memcpy(pkt->data, frame->frame_record, BYTES_PER_FRAME_RECORD); - if(vmd->is_indeo3 && frame->frame_record[0] == 0x02) + if(vmd->is_indeo3 && frame->frame_record[0] == 0x02) { ret = ffio_read_size(pb, pkt->data, frame->frame_size); - else + av_shrink_packet(pkt, frame->frame_size); + } else ret = ffio_read_size(pb, pkt->data + BYTES_PER_FRAME_RECORD, frame->frame_size); -- 2.52.0 >From 8084419ad4a150dfa34aebdf83e774605bf2db96 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:19:08 +0200 Subject: [PATCH 9/9] avformat/dxa: Check the CMAP palette read Fixes: use of uninitialized memory Fixes: ECBvN9BwPDuw Fixes: AISLE-2026-0111-00237 Use of uninitialized memory Replicated through UnModified FFmpeg (ffprobe, tcp with -rw_timeout) with Valgrind Found-by: Joshua Rogers <[email protected]> --- libavformat/dxa.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/dxa.c b/libavformat/dxa.c index 76bc7a543d..cc3c33c887 100644 --- a/libavformat/dxa.c +++ b/libavformat/dxa.c @@ -198,7 +198,8 @@ static int dxa_read_packet(AVFormatContext *s, AVPacket *pkt) case MKTAG('C', 'M', 'A', 'P'): pal_size = 768+4; memcpy(pal, buf, 4); - avio_read(s->pb, pal + 4, 768); + if ((ret = ffio_read_size(s->pb, pal + 4, 768)) < 0) + return ret; break; case MKTAG('F', 'R', 'A', 'M'): if ((ret = avio_read(s->pb, buf + 4, DXA_EXTRA_SIZE - 4)) != DXA_EXTRA_SIZE - 4) { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
