PR #25715 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715.patch
>From fb9c3f65b7d307c6091f504481a1d6c39a973fc3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 04:25:47 +0100 Subject: [PATCH 1/7] avcodec/gemdec: clear the row buffer before decoding Fixes: pqQviaXoqzKF Fixes: AISLE-2026-0150-00236 Fixes: use of uninitialized memory Use of uninitialized memory Replicated through UnModified FFmpeg with MSAN Found-by: Joshua Rogers (AISLE) --- libavcodec/gemdec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/gemdec.c b/libavcodec/gemdec.c index 07f01a24a11..62907f528a9 100644 --- a/libavcodec/gemdec.c +++ b/libavcodec/gemdec.c @@ -259,6 +259,7 @@ static int gem_decode_frame(AVCodecContext *avctx, AVFrame *p, if (ret < 0) return ret; row = avctx->priv_data; + memset(row, 0, planes * row_width); memset(p->data[0], 0, avctx->height * p->linesize[0]); b = buf + header_size * 2; -- 2.54.0 >From 4bf2b081fc80a08d98567a3076967b442a460a21 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 04:25:52 +0100 Subject: [PATCH 2/7] avcodec/webp: reject uncompressed alpha chunks shorter than the image Fixes: 8VUuZb6oh1t5 Fixes: AISLE-2026-0150-00187 Fixes: disclosure of previous frame content Disclosure of previous frame content Replicated through UnModified FFmpeg (image sequence of 40 lossy images with alpha 0xAA followed by one with a 4 byte uncompressed ALPH chunk, the alpha plane of the last frame shows 0xAA) Found-by: Joshua Rogers (AISLE) --- libavcodec/webp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/webp.c b/libavcodec/webp.c index e4174f08288..1dbce62e1c3 100644 --- a/libavcodec/webp.c +++ b/libavcodec/webp.c @@ -1257,6 +1257,8 @@ static int vp8_lossy_decode_alpha(AVCodecContext *avctx, AVFrame *p, if (s->alpha_compression == ALPHA_COMPRESSION_NONE) { GetByteContext gb; + if (data_size < s->width * s->height) + return AVERROR_INVALIDDATA; bytestream2_init(&gb, data_start, data_size); for (y = 0; y < s->height; y++) bytestream2_get_buffer(&gb, p->data[3] + p->linesize[3] * y, -- 2.54.0 >From 460c1055e152bf815d362ccdc80ce7af5df58837 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 04:28:58 +0100 Subject: [PATCH 3/7] avcodec/c93: fail on truncated color tables Fixes: Ao8AXNwB2RlH Fixes: AISLE-2026-0150-00011 Fixes: use of uninitialized memory Use of uninitialized memory Replicated through UnModified FFmpeg with MSAN Found-by: Joshua Rogers (AISLE) --- libavcodec/c93.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/libavcodec/c93.c b/libavcodec/c93.c index da103bec406..03c007d35d3 100644 --- a/libavcodec/c93.c +++ b/libavcodec/c93.c @@ -195,7 +195,8 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe, break; case C93_8X8_2COLOR: - bytestream2_get_buffer(&gb, cols, 2); + if (bytestream2_get_buffer(&gb, cols, 2) != 2) + return AVERROR_INVALIDDATA; for (i = 0; i < 8; i++) { draw_n_color(out + i*stride, stride, 8, 1, 1, cols, NULL, bytestream2_get_byte(&gb)); @@ -209,15 +210,18 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe, for (int j = 0; j < 8; j += 4) { for (i = 0; i < 8; i += 4) { if (block_type == C93_4X4_2COLOR) { - bytestream2_get_buffer(&gb, cols, 2); + if (bytestream2_get_buffer(&gb, cols, 2) != 2) + return AVERROR_INVALIDDATA; draw_n_color(out + i + j*stride, stride, 4, 4, 1, cols, NULL, bytestream2_get_le16(&gb)); } else if (block_type == C93_4X4_4COLOR) { - bytestream2_get_buffer(&gb, cols, 4); + if (bytestream2_get_buffer(&gb, cols, 4) != 4) + return AVERROR_INVALIDDATA; draw_n_color(out + i + j*stride, stride, 4, 4, 2, cols, NULL, bytestream2_get_le32(&gb)); } else { - bytestream2_get_buffer(&gb, grps, 4); + if (bytestream2_get_buffer(&gb, grps, 4) != 4) + return AVERROR_INVALIDDATA; draw_n_color(out + i + j*stride, stride, 4, 4, 1, cols, grps, bytestream2_get_le16(&gb)); } -- 2.54.0 >From 2fb6fce8ff9527faa5436df93a6d4bb989019550 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 04:28:59 +0100 Subject: [PATCH 4/7] avcodec/rawdec: require a full row of input per line for 1 to 8 bits per pixel Fixes: Wq9WI8WzfMaj Fixes: AISLE-2026-0150-00106 Fixes: use of uninitialized memory Use of uninitialized memory Replicated through UnModified FFmpeg with MSAN Found-by: Joshua Rogers (AISLE) --- libavcodec/rawdec.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c index 53d1fba5839..69df3efcaa3 100644 --- a/libavcodec/rawdec.c +++ b/libavcodec/rawdec.c @@ -205,6 +205,12 @@ static int raw_decode(AVCodecContext *avctx, AVFrame *frame, (context->is_mono || context->is_pal8) && (!avctx->codec_tag || avctx->codec_tag == MKTAG('r','a','w',' ') || context->is_nut_mono || context->is_nut_pal8)) { + int bits = context->is_mono ? 1 : + avctx->bits_per_coded_sample ? avctx->bits_per_coded_sample : 8; + if (stride < ((int64_t)avctx->width * bits + 7) / 8) { + av_log(avctx, AV_LOG_ERROR, "Packet too small (%d)\n", avpkt->size); + return AVERROR_INVALIDDATA; + } context->is_1_2_4_8_bpp = 1; if (context->is_mono) { int row_bytes = avctx->width / 8 + (avctx->width & 7 ? 1 : 0); -- 2.54.0 >From 9ea417e243d179ef040b157a015581ab49bb16d7 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 04:28:59 +0100 Subject: [PATCH 5/7] avcodec/exr: compute the tile count in 64 bits Fixes: ZF6qKuDyIHUD Fixes: AISLE-2026-0150-00476 Fixes: disclosure of previous frame content Disclosure of previous frame content Replicated through UnModified FFmpeg Found-by: Joshua Rogers (AISLE) --- libavcodec/exr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/exr.c b/libavcodec/exr.c index 0e9c734a106..d53bd9ba405 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -2090,7 +2090,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture, int i, y, ret, ymax; int planes; int out_line_size; - int nb_blocks; /* nb scanline or nb tile */ + int64_t nb_blocks; /* nb scanline or nb tile */ uint64_t start_offset_table; uint64_t start_next_scanline; @@ -2217,7 +2217,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture, if (s->tile_attr.ySize <= 0 || s->tile_attr.xSize <= 0) return AVERROR_INVALIDDATA; nb_blocks = ((s->xdelta + s->tile_attr.xSize - 1) / s->tile_attr.xSize) * - ((s->ydelta + s->tile_attr.ySize - 1) / s->tile_attr.ySize); + (int64_t)((s->ydelta + s->tile_attr.ySize - 1) / s->tile_attr.ySize); } else { /* scanline */ nb_blocks = (s->ydelta + s->scan_lines_per_block - 1) / s->scan_lines_per_block; -- 2.54.0 >From cb6e7d637e520ab70f7cd1cdcd230769a039a600 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 04:29:14 +0100 Subject: [PATCH 6/7] avcodec/tiertexseqv: check the RLE block unpacking before copying the block Fixes: V9Z2ZdGQsUo6 Fixes: AISLE-2026-0150-00048 Fixes: use of uninitialized memory Use of uninitialized memory Replicated through UnModified FFmpeg with MSAN Found-by: Joshua Rogers (AISLE) --- libavcodec/tiertexseqv.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/tiertexseqv.c b/libavcodec/tiertexseqv.c index 31acc9b438d..9a7eb70ee8e 100644 --- a/libavcodec/tiertexseqv.c +++ b/libavcodec/tiertexseqv.c @@ -92,6 +92,8 @@ static const unsigned char *seq_decode_op1(SeqVideoContext *seq, switch (len & 3) { case 1: src = seq_unpack_rle_block(src, src_end, block, sizeof(block)); + if (!src) + return NULL; for (b = 0; b < 8; b++) { memcpy(dst, &block[b * 8], 8); dst += seq->frame->linesize[0]; @@ -99,6 +101,8 @@ static const unsigned char *seq_decode_op1(SeqVideoContext *seq, break; case 2: src = seq_unpack_rle_block(src, src_end, block, sizeof(block)); + if (!src) + return NULL; for (i = 0; i < 8; i++) { for (b = 0; b < 8; b++) dst[b * seq->frame->linesize[0]] = block[i * 8 + b]; -- 2.54.0 >From ee3f41b3c39ce70d9d2a711b82f084e155bd0dec Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 04:29:28 +0100 Subject: [PATCH 7/7] avcodec/tiertexseqv: reject RLE code tables that do not cover the block Found during triage of the security report V9Z2ZdGQsUo6 Fixes: V9Z2ZdGQsUo6 Fixes: use of uninitialized memory Use of uninitialized memory Replicated through UnModified FFmpeg with MSAN --- libavcodec/tiertexseqv.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/tiertexseqv.c b/libavcodec/tiertexseqv.c index 9a7eb70ee8e..c3fee8f0a06 100644 --- a/libavcodec/tiertexseqv.c +++ b/libavcodec/tiertexseqv.c @@ -72,6 +72,8 @@ static const unsigned char *seq_unpack_rle_block(const unsigned char *src, dst += len; dst_size -= len; } + if (dst_size > 0) + return NULL; return src; } -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
