PR #25020 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25020 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25020.patch
>From 62707c9c589f05bb087eff2801e8e5ded75a54bf Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 10 Oct 2026 07:09:02 +0200 Subject: [PATCH 01/11] avcodec/lcldec: check the packet size before reading the ZLIB multithread header Fixes: heap-buffer-overflow (read) Fixes: G8jPOZLbzYtj Fixes: ANT-2026-22YEN9NA Fixes: lcl-zlib-mt-shortlace.mkv Found-by: Claude and Ada Logics Out of array read Replicated through UnModified FFmpeg with ASAN --- libavcodec/lcldec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c index ad40c58546..f6c8bc7051 100644 --- a/libavcodec/lcldec.c +++ b/libavcodec/lcldec.c @@ -283,6 +283,10 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame, break; } } else if (c->flags & FLAG_MULTITHREAD) { + if (len < 8) { + av_log(avctx, AV_LOG_ERROR, "len %d is too small\n", len); + return AVERROR_INVALIDDATA; + } mthread_inlen = AV_RL32(buf); mthread_inlen = FFMIN(mthread_inlen, len - 8); mthread_outlen = AV_RL32(buf + 4); -- 2.52.0 >From 822447174fb2985cbe79cee47a1837a80e2ee131 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 10 Oct 2026 07:10:21 +0200 Subject: [PATCH 02/11] avfilter/vf_median: reject widths whose fine histogram size overflows an int Fixes: heap-buffer-overflow (read and write) Fixes: signed integer overflow Fixes: IhY7QcsV5nva Fixes: ANT-2026-RYWQTXHH Fixes: poc-median-65600x4.pgm Found-by: Claude and Ada Logics Out of array access Replicated through UnModified FFmpeg with ASAN and UBSAN --- libavfilter/vf_median.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavfilter/vf_median.c b/libavfilter/vf_median.c index 3b11adbcad..5398932436 100644 --- a/libavfilter/vf_median.c +++ b/libavfilter/vf_median.c @@ -143,6 +143,11 @@ static int config_input(AVFilterLink *inlink) s->nb_threads = FFMAX(1, FFMIN(s->planeheight[1] / (s->radiusV + 1), ff_filter_get_nb_threads(inlink->dst))); s->bins = 1 << ((s->depth + 1) / 2); + if (inlink->w > INT_MAX / (s->bins * s->bins)) { + av_log(inlink->dst, AV_LOG_ERROR, "Width %d is too large for depth %d\n", + inlink->w, s->depth); + return AVERROR(EINVAL); + } s->fine_size = s->bins * s->bins * inlink->w; s->coarse_size = s->bins * inlink->w; s->coarse = av_calloc(s->nb_threads, sizeof(*s->coarse)); -- 2.52.0 >From 1fee0da67679613e93809314e9dc4784c606fdfd Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 10 Oct 2026 07:13:43 +0200 Subject: [PATCH 03/11] avcodec/cbs_h266: reject an empty SPS conformance window Fixes: heap-buffer-overflow (read) Fixes: q0RFgfMenefI Fixes: ANT-2026-HRT03RV0 Fixes: vvc-subpic-tiles.mkv Found-by: Claude and Ada Logics Out of array read Replicated through UnModified FFmpeg with ASAN --- libavcodec/cbs_h266_syntax_template.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c index 9e0776defe..825f6ad2d0 100644 --- a/libavcodec/cbs_h266_syntax_template.c +++ b/libavcodec/cbs_h266_syntax_template.c @@ -1113,12 +1113,12 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw, flag(sps_conformance_window_flag); if (current->sps_conformance_window_flag) { - uint16_t width = current->sps_pic_width_max_in_luma_samples / sub_width_c; - uint16_t height = current->sps_pic_height_max_in_luma_samples / sub_height_c; - ue(sps_conf_win_left_offset, 0, width); - ue(sps_conf_win_right_offset, 0, width - current->sps_conf_win_left_offset); - ue(sps_conf_win_top_offset, 0, height); - ue(sps_conf_win_bottom_offset, 0, height - current->sps_conf_win_top_offset); + uint16_t max_offsets_x = (current->sps_pic_width_max_in_luma_samples - 1) / sub_width_c; + uint16_t max_offsets_y = (current->sps_pic_height_max_in_luma_samples - 1) / sub_height_c; + ue(sps_conf_win_left_offset, 0, max_offsets_x); + ue(sps_conf_win_right_offset, 0, max_offsets_x - current->sps_conf_win_left_offset); + ue(sps_conf_win_top_offset, 0, max_offsets_y); + ue(sps_conf_win_bottom_offset, 0, max_offsets_y - current->sps_conf_win_top_offset); } else { infer(sps_conf_win_left_offset, 0); infer(sps_conf_win_right_offset, 0); -- 2.52.0 >From c5d86e421b68b032f4c336a0d8aa058a5ad83500 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 10 Oct 2026 07:15:27 +0200 Subject: [PATCH 04/11] avcodec/cbs_h266: reject SPS virtual boundaries when the resolution may change Fixes: negative-size-param Fixes: left shift of negative value Fixes: 0IMcpiRlVAb5 Fixes: ANT-2026-QY2HYS5A Fixes: poc.mkv Found-by: Claude and Ada Logics Negative size memcpy Replicated through UnModified FFmpeg with ASAN and UBSAN --- libavcodec/cbs_h266_syntax_template.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c index 825f6ad2d0..47984b8596 100644 --- a/libavcodec/cbs_h266_syntax_template.c +++ b/libavcodec/cbs_h266_syntax_template.c @@ -1584,7 +1584,7 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw, flag(sps_virtual_boundaries_enabled_flag); if (current->sps_virtual_boundaries_enabled_flag) { - flag(sps_virtual_boundaries_present_flag); + u(1, sps_virtual_boundaries_present_flag, 0, !current->sps_res_change_in_clvs_allowed_flag); if (current->sps_virtual_boundaries_present_flag) { ue(sps_num_ver_virtual_boundaries, 0, current->sps_pic_width_max_in_luma_samples <= 8 ? 0 : VVC_MAX_VBS); -- 2.52.0 >From c8922911dceb19a4c46d9d44749b21124cf38272 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 10 Oct 2026 07:16:08 +0200 Subject: [PATCH 05/11] avcodec/vvc/ps: do not truncate the virtual boundary position limit to 16 bits Fixes: negative-size-param Fixes: left shift of negative value Fixes: 0IMcpiRlVAb5 Fixes: ANT-2026-QY2HYS5A Fixes: poc.mkv Found-by: Claude and Ada Logics Negative size memcpy Replicated through UnModified FFmpeg with ASAN and UBSAN --- libavcodec/vvc/ps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/vvc/ps.c b/libavcodec/vvc/ps.c index d40c8050db..91d2cb1798 100644 --- a/libavcodec/vvc/ps.c +++ b/libavcodec/vvc/ps.c @@ -928,7 +928,7 @@ static int ph_max_num_subblock_merge_cand(const H266RawSPS *sps, const H266RawPi return sps->sps_sbtmvp_enabled_flag && ph->ph_temporal_mvp_enabled_flag; } -static int ph_vb_pos(uint16_t *vbs, uint8_t *num_vbs, const uint16_t *pos_minus_1, const uint8_t num_pos, uint16_t max, const int ctb_size_y) +static int ph_vb_pos(uint16_t *vbs, uint8_t *num_vbs, const uint16_t *pos_minus_1, const uint8_t num_pos, int max, const int ctb_size_y) { max = FF_CEIL_RSHIFT(max, 3) - 2; for (int i = 0; i < num_pos; i++) { -- 2.52.0 >From 01613b4f8f447ab2c6782faf875d079d83f406d8 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 10 Oct 2026 07:19:58 +0200 Subject: [PATCH 06/11] avcodec/mjpegdec: set the AVID frame height and cropping before flipping Fixes: heap-buffer-overflow (read) Fixes: NzELYSvufGfQ Fixes: ANT-2026-324B3XNF Fixes: ant-324b3xnf-avrn-64x32-flipped.avi Found-by: Claude and Ada Logics Out of array read Replicated through UnModified FFmpeg with ASAN --- libavcodec/mjpegdec.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index 3dc8662abb..2bd5a491c9 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -2761,6 +2761,14 @@ the_end: } } } + if (avctx->codec_id != AV_CODEC_ID_SMVJPEG && + (avctx->codec_tag == MKTAG('A', 'V', 'R', 'n') || + avctx->codec_tag == MKTAG('A', 'V', 'D', 'J')) && + avctx->coded_height > s->orig_height) { + frame->height = AV_CEIL_RSHIFT(avctx->coded_height, avctx->lowres); + frame->crop_top = frame->height - avctx->height; + } + if (s->flipped && !s->rgb && !s->bayer) { ret = av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &hshift, &vshift); if (ret) @@ -2873,14 +2881,6 @@ the_end: av_log(avctx, AV_LOG_WARNING, "couldn't attach EXIF metadata\n"); } - if (avctx->codec_id != AV_CODEC_ID_SMVJPEG && - (avctx->codec_tag == MKTAG('A', 'V', 'R', 'n') || - avctx->codec_tag == MKTAG('A', 'V', 'D', 'J')) && - avctx->coded_height > s->orig_height) { - frame->height = AV_CEIL_RSHIFT(avctx->coded_height, avctx->lowres); - frame->crop_top = frame->height - avctx->height; - } - the_end_no_picture: av_log(avctx, AV_LOG_DEBUG, "decode frame unused %td bytes\n", buf_end - buf_ptr); -- 2.52.0 >From 6572a799bc907ee5ab2721b0007cfb9fe244cdea Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 10 Oct 2026 07:20:27 +0200 Subject: [PATCH 07/11] avutil/frame: compute the cropping offsets as ptrdiff_t Found during triage/review of the security report NzELYSvufGfQ (ANT-2026-324B3XNF), which does not report this. Fixes: pointer overflow Pointer overflow Replicated through UnModified FFmpeg with UBSAN --- libavutil/frame.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavutil/frame.c b/libavutil/frame.c index ca8e8486a3..1e00b243e1 100644 --- a/libavutil/frame.c +++ b/libavutil/frame.c @@ -727,7 +727,7 @@ void av_frame_remove_side_data(AVFrame *frame, enum AVFrameSideDataType type) av_frame_side_data_remove(&frame->side_data, &frame->nb_side_data, type); } -static int calc_cropping_offsets(size_t offsets[4], const AVFrame *frame, +static int calc_cropping_offsets(ptrdiff_t offsets[4], const AVFrame *frame, const AVPixFmtDescriptor *desc) { for (int i = 0; frame->data[i]; i++) { @@ -750,8 +750,8 @@ static int calc_cropping_offsets(size_t offsets[4], const AVFrame *frame, if (!comp) return AVERROR_BUG; - offsets[i] = (frame->crop_top >> shift_y) * frame->linesize[i] + - (frame->crop_left >> shift_x) * comp->step; + offsets[i] = (ptrdiff_t)(frame->crop_top >> shift_y) * frame->linesize[i] + + (ptrdiff_t)(frame->crop_left >> shift_x) * comp->step; } return 0; @@ -760,7 +760,7 @@ static int calc_cropping_offsets(size_t offsets[4], const AVFrame *frame, int av_frame_apply_cropping(AVFrame *frame, int flags) { const AVPixFmtDescriptor *desc; - size_t offsets[4]; + ptrdiff_t offsets[4]; int ret; if (!(frame->width > 0 && frame->height > 0)) -- 2.52.0 >From ddc05074f4e34d0605c3abe0c3579de62fbd396f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 10 Oct 2026 07:22:41 +0200 Subject: [PATCH 08/11] avcodec/aacsbr: turn SBR off when the USAC SBR data cannot be parsed Fixes: heap-buffer-overflow (write) Fixes: GITTfi6VsK4u Fixes: ANT-2026-5KX1BXM6 Fixes: poc.flv Found-by: Claude and Ada Logics Out of array write Replicated through UnModified FFmpeg with ASAN --- libavcodec/aacsbr_template.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/libavcodec/aacsbr_template.c b/libavcodec/aacsbr_template.c index cc22b64416..f398d79a61 100644 --- a/libavcodec/aacsbr_template.c +++ b/libavcodec/aacsbr_template.c @@ -1210,12 +1210,11 @@ int ff_aac_sbr_config_usac(AACDecContext *ac, ChannelElement *che, return 0; } -int ff_aac_sbr_decode_usac_data(AACDecContext *ac, ChannelElement *che, - AACUsacElemConfig *ue, GetBitContext *gb, - int sbr_ch, int indep_flag) +static int read_usac_sbr_data(AACDecContext *ac, SpectralBandReplication *sbr, + AACUsacElemConfig *ue, GetBitContext *gb, + int sbr_ch, int indep_flag) { int ret; - SpectralBandReplication *sbr = get_sbr(che); int info_present = 1; int header_present = 1; @@ -1356,6 +1355,19 @@ int ff_aac_sbr_decode_usac_data(AACDecContext *ac, ChannelElement *che, return 0; } + +int ff_aac_sbr_decode_usac_data(AACDecContext *ac, ChannelElement *che, + AACUsacElemConfig *ue, GetBitContext *gb, + int sbr_ch, int indep_flag) +{ + SpectralBandReplication *sbr = get_sbr(che); + int ret = read_usac_sbr_data(ac, sbr, ue, gb, sbr_ch, indep_flag); + + if (ret < 0) + sbr_turnoff(sbr); + + return ret; +} #endif /** -- 2.52.0 >From 28bf8c5d689b30e898a4d09cd0a88c54c0271641 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 10 Oct 2026 07:23:56 +0200 Subject: [PATCH 09/11] avcodec/huffyuvdec: budget 33 bits per sample when choosing the unchecked 16 bit loop Fixes: heap-buffer-overflow (read) Fixes: BIqbuSbTJqAH Fixes: ANT-2026-V2EPGE9M Fixes: poc.avi Found-by: Claude and Ada Logics Out of array read Replicated through UnModified FFmpeg with ASAN --- libavcodec/huffyuvdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/huffyuvdec.c b/libavcodec/huffyuvdec.c index 78bd3d99b3..ff982deeab 100644 --- a/libavcodec/huffyuvdec.c +++ b/libavcodec/huffyuvdec.c @@ -760,7 +760,7 @@ static void decode_plane_bitstream(HYuvDecContext *s, int width, int plane) s->temp16[0][width - 1] = 0; CLOSE_READER(re, &s->gb); } else { - if (count >= (get_bits_left(&s->gb)) / (32 * 2)) { + if (count >= (get_bits_left(&s->gb)) / (33 * 2)) { for (i = 0; i < count && get_bits_left(&s->gb) > 0; i++) { READ_2PIX_PLANE16(s->temp16[0][2 * i], s->temp16[0][2 * i + 1], plane); } -- 2.52.0 >From c1a3ca10dcb6c998cb2b07c64830930015d4f8eb Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 10 Oct 2026 07:24:31 +0200 Subject: [PATCH 10/11] avfilter/vf_tonemap: pass the alpha row width, not the linesize, to av_image_copy_plane() Fixes: negative-size-param Fixes: assertion failure Fixes: wzomtdUBffdP Fixes: ANT-2026-G2YFQ5N2 Fixes: poc.exr Found-by: Claude and Ada Logics Negative size memcpy and assertion failure Replicated through UnModified FFmpeg with ASAN --- libavfilter/vf_tonemap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavfilter/vf_tonemap.c b/libavfilter/vf_tonemap.c index c5be4b1510..40bed9b394 100644 --- a/libavfilter/vf_tonemap.c +++ b/libavfilter/vf_tonemap.c @@ -263,7 +263,7 @@ static int filter_frame(AVFilterLink *link, AVFrame *in) if (desc->flags & AV_PIX_FMT_FLAG_ALPHA && odesc->flags & AV_PIX_FMT_FLAG_ALPHA) { av_image_copy_plane(out->data[3], out->linesize[3], in->data[3], in->linesize[3], - out->linesize[3], outlink->h); + out->width * odesc->comp[3].step, outlink->h); } else if (odesc->flags & AV_PIX_FMT_FLAG_ALPHA) { for (y = 0; y < out->height; y++) { for (x = 0; x < out->width; x++) { -- 2.52.0 >From 7d766f2de9dc2b1a38f2d316b8e43c3c564e5830 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 10 Oct 2026 07:25:28 +0200 Subject: [PATCH 11/11] avcodec/cbs_sei: clear the message slot handed out by ff_cbs_sei_list_add() Fixes: heap-use-after-free Fixes: YtyT0QH1InrQ Fixes: ANT-2026-13DK7NZD Fixes: poc.264 Found-by: Claude and Ada Logics Use after free Replicated through UnModified FFmpeg with ASAN --- libavcodec/cbs_sei.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/libavcodec/cbs_sei.c b/libavcodec/cbs_sei.c index f354a10029..4f04b9ff83 100644 --- a/libavcodec/cbs_sei.c +++ b/libavcodec/cbs_sei.c @@ -279,11 +279,8 @@ int ff_cbs_sei_list_add(SEIRawMessageList *list) list->messages = ptr; list->nb_messages_allocated = new_count; - - // Zero the newly-added entries. - memset(list->messages + old_count, 0, - (new_count - old_count) * sizeof(*list->messages)); } + memset(&list->messages[list->nb_messages], 0, sizeof(*list->messages)); ++list->nb_messages; return 0; } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
