PR #25217 opened by Forgejo_Fairy URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25217 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25217.patch
Backport the guard from upstream 61e73851a33 to release/5.0 for #22777 (CVE-2023-51796). This uses the [reporter’s submitted patch](https://patchwork.ffmpeg.org/project/ffmpeg/patch/[email protected]/) and preserves their commit authorship. On the final buffered audio frame, `flush_idx` advances beyond the stored PTS values. Calculating timestamp compensation then reads `s->pts[flush_idx]` out of bounds. The guard calculates compensation only while another frame remains. Verification on arm64 with Clang/ASan and `--disable-asm`: - The attached PoC triggers an eight-byte heap-buffer-overflow on release/5.0 head 0fd03b22140. - The same `-i poc -filter_complex areverse` command completes without an ASan error after this patch and produces an MP4. - The PoC passes on 0370c3e3d4d and fails on 45dc668aea0, confirming the introducing commit. - `git diff --check` passes. The PoC emits MP3 decode errors on both patched and unpatched builds; the ASan overflow is resolved by this change. From f3e7c4bee238831449b38f023eba7e6f489e0c35 Mon Sep 17 00:00:00 2001 From: "lizhixuan.HUST" <[email protected]> Date: Fri, 10 Apr 2026 03:58:16 +0000 Subject: [PATCH] avfilter/f_reverse: avoid reading past PTS array on final areverse frame After outputting the last buffered frame, flush_idx points beyond the stored PTS values. Only calculate timestamp compensation when another frame remains. Fixes: #22777 CVE: CVE-2023-51796 Found-by: Zeng Yunxiang Signed-off-by: lizhixuan.HUST <[email protected]> (cherry picked from commit 61e73851a33f0b4cb7662f8578a4695e77bd3c19) Assisted-by: Fairy --- libavfilter/f_reverse.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavfilter/f_reverse.c b/libavfilter/f_reverse.c index f7a7e716fa..d39b7b2428 100644 --- a/libavfilter/f_reverse.c +++ b/libavfilter/f_reverse.c @@ -251,7 +251,8 @@ static int areverse_request_frame(AVFilterLink *outlink) if (ret == AVERROR_EOF && s->nb_frames > 0) { AVFrame *out = s->frames[s->nb_frames - 1]; out->pts = s->pts[s->flush_idx++] - s->nb_samples; - s->nb_samples += s->pts[s->flush_idx] - s->pts[s->flush_idx - 1] - out->nb_samples; + if (s->nb_frames > 1) + s->nb_samples += s->pts[s->flush_idx] - s->pts[s->flush_idx - 1] - out->nb_samples; if (av_sample_fmt_is_planar(out->format)) reverse_samples_planar(out); -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
