PR #25604 opened by Kacper Michajłow (kasper93) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25604 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25604.patch
From fa04385c5b2ddce8f64aa6b6dfe5995c8c9047e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <[email protected]> Date: Thu, 29 Oct 2026 21:56:57 +0100 Subject: [PATCH 1/3] avformat/nsvdec: do not allocate the declared info strings size MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The NSVf header declares the size of its info strings, up to 2 GiB, and the buffer was allocated and zeroed before reading them, also when the file is much shorter. Read them with avio_read_to_bprint(), which allocates as the data arrives. Fixes: OOM Fixes: clusterfuzz-testcase-fuzzer_protocol_memory-6327893299625984 Fixes: clusterfuzz-testcase-fuzzer_protocol_edl-5153066277208064 Found-by: https://github.com/google/oss-fuzz/tree/master/projects/mpv Signed-off-by: Kacper Michajłow <[email protected]> --- libavformat/nsvdec.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c index 9b945a7c12c..b18fc46a4e7 100644 --- a/libavformat/nsvdec.c +++ b/libavformat/nsvdec.c @@ -22,6 +22,7 @@ */ #include "libavutil/attributes.h" +#include "libavutil/bprint.h" #include "libavutil/mathematics.h" #include "libavutil/mem.h" #include "avformat.h" @@ -301,16 +302,20 @@ static int nsv_parse_NSVf_header(AVFormatContext *s) av_log(s, AV_LOG_TRACE, "NSV got header; filepos %"PRId64"\n", avio_tell(pb)); if (strings_size > 0) { - char *strings; /* last byte will be '\0' to play safe with str*() */ + AVBPrint strings; char *p, *endp; char *token, *value; char quote; + int ret; - p = strings = av_mallocz((size_t)strings_size + 1); - if (!p) - return AVERROR(ENOMEM); - endp = strings + strings_size; - avio_read(pb, strings, strings_size); + av_bprint_init(&strings, 0, AV_BPRINT_SIZE_UNLIMITED); + ret = avio_read_to_bprint(pb, &strings, strings_size); + if (ret < 0) { + av_bprint_finalize(&strings, NULL); + return ret; + } + p = strings.str; + endp = strings.str + strings.len; while (p < endp) { while (*p == ' ') p++; /* strip out spaces */ @@ -330,7 +335,7 @@ static int nsv_parse_NSVf_header(AVFormatContext *s) av_log(s, AV_LOG_TRACE, "NSV NSVf INFO: %s='%s'\n", token, value); av_dict_set(&s->metadata, token, value, 0); } - av_free(strings); + av_bprint_finalize(&strings, NULL); } if (avio_feof(pb)) return -1; -- 2.54.0 From 9cf0f50881386f244ad9ee0eb18779f205f60b4d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <[email protected]> Date: Thu, 29 Oct 2026 21:56:57 +0100 Subject: [PATCH 2/3] avformat/vividas: allocate the SB entries per block MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit track_index() allocated entries for the largest packet count in the index, up to INT_MAX, before any block was read. Allocate them in load_sb_block() for the loaded block, and skip a block that declares more packets than fit in it, as each entry takes at least two bytes. Fixes: OOM Fixes: clusterfuzz-testcase-fuzzer_protocol_lavf-6404424499789824 Found-by: https://github.com/google/oss-fuzz/tree/master/projects/mpv Signed-off-by: Kacper Michajłow <[email protected]> --- libavformat/vividas.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/libavformat/vividas.c b/libavformat/vividas.c index 23f010d25cc..54c7374c0f6 100644 --- a/libavformat/vividas.c +++ b/libavformat/vividas.c @@ -440,7 +440,6 @@ static int track_index(VividasDemuxContext *viv, AVFormatContext *s, { int64_t off; int64_t poff; - int maxnp=0; FFIOContext pb0; AVIOContext *const pb = &pb0.pub; int i; @@ -478,18 +477,11 @@ static int track_index(VividasDemuxContext *viv, AVFormatContext *s, off += viv->sb_blocks[i].size; poff += viv->sb_blocks[i].n_packets; - - if (maxnp < viv->sb_blocks[i].n_packets) - maxnp = viv->sb_blocks[i].n_packets; } if (filesize > 0 && poff > filesize) return AVERROR_INVALIDDATA; - viv->sb_entries = av_calloc(maxnp, sizeof(VIV_SB_entry)); - if (!viv->sb_entries) - return AVERROR(ENOMEM); - return 0; } @@ -526,6 +518,14 @@ static void load_sb_block(AVFormatContext *s, VividasDemuxContext *viv, unsigned viv->n_sb_entries = viv->sb_blocks[viv->current_sb].n_packets; + // Each entry takes at least two bytes of the block. + if (viv->n_sb_entries > size / 2 || + av_reallocp_array(&viv->sb_entries, viv->n_sb_entries, + sizeof(*viv->sb_entries)) < 0) { + viv->n_sb_entries = 0; + return; + } + for (i = 0; i < viv->n_sb_entries; i++) { viv->sb_entries[i].size = ffio_read_varlen(pb); viv->sb_entries[i].flag = avio_r8(pb); -- 2.54.0 From 2ed544c7ca197b7894382637bc6f2d679c47c025 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <[email protected]> Date: Thu, 29 Oct 2026 22:51:19 +0100 Subject: [PATCH 3/3] avcodec/hdrdec: avoid an integer overflow in the input size check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes: signed integer overflow: 701411834 * 4 cannot be represented in type 'int' Fixes: 536328675/clusterfuzz-testcase-minimized-fuzzer_loadfile-4748225916239872 Found-by: https://github.com/google/oss-fuzz/tree/master/projects/mpv Signed-off-by: Kacper Michajłow <[email protected]> --- libavcodec/hdrdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c index 7f3b830b6d6..a74848eee55 100644 --- a/libavcodec/hdrdec.c +++ b/libavcodec/hdrdec.c @@ -126,7 +126,7 @@ static int hdr_decode_frame(AVCodecContext *avctx, AVFrame *p, ; } - if (bytestream2_get_bytes_left(&gb) < height * 4) + if (bytestream2_get_bytes_left(&gb) < height * 4LL) return AVERROR_INVALIDDATA; if ((ret = ff_set_dimensions(avctx, width, height)) < 0) -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
