PR #25783 opened by ffmpeg-devel URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25783 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25783.patch
**Backport:** https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25604 From db1b4af63d8ac93deeaf05114fa8c32f45f38ba6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <[email protected]> Date: Thu, 29 Oct 2026 21:56:57 +0100 Subject: [PATCH 1/3] avformat/nsvdec: do not allocate the declared info strings size MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The NSVf header declares the size of its info strings, up to 2 GiB, and the buffer was allocated and zeroed before reading them, also when the file is much shorter. Read them with avio_read_to_bprint(), which allocates as the data arrives. Fixes: OOM Fixes: clusterfuzz-testcase-fuzzer_protocol_memory-6327893299625984 Fixes: clusterfuzz-testcase-fuzzer_protocol_edl-5153066277208064 Found-by: https://github.com/google/oss-fuzz/tree/master/projects/mpv Signed-off-by: Kacper Michajłow <[email protected]> (cherry picked from commit fa04385c5b2ddce8f64aa6b6dfe5995c8c9047e8) --- libavformat/nsvdec.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c index 9b945a7c12c..b18fc46a4e7 100644 --- a/libavformat/nsvdec.c +++ b/libavformat/nsvdec.c @@ -22,6 +22,7 @@ */ #include "libavutil/attributes.h" +#include "libavutil/bprint.h" #include "libavutil/mathematics.h" #include "libavutil/mem.h" #include "avformat.h" @@ -301,16 +302,20 @@ static int nsv_parse_NSVf_header(AVFormatContext *s) av_log(s, AV_LOG_TRACE, "NSV got header; filepos %"PRId64"\n", avio_tell(pb)); if (strings_size > 0) { - char *strings; /* last byte will be '\0' to play safe with str*() */ + AVBPrint strings; char *p, *endp; char *token, *value; char quote; + int ret; - p = strings = av_mallocz((size_t)strings_size + 1); - if (!p) - return AVERROR(ENOMEM); - endp = strings + strings_size; - avio_read(pb, strings, strings_size); + av_bprint_init(&strings, 0, AV_BPRINT_SIZE_UNLIMITED); + ret = avio_read_to_bprint(pb, &strings, strings_size); + if (ret < 0) { + av_bprint_finalize(&strings, NULL); + return ret; + } + p = strings.str; + endp = strings.str + strings.len; while (p < endp) { while (*p == ' ') p++; /* strip out spaces */ @@ -330,7 +335,7 @@ static int nsv_parse_NSVf_header(AVFormatContext *s) av_log(s, AV_LOG_TRACE, "NSV NSVf INFO: %s='%s'\n", token, value); av_dict_set(&s->metadata, token, value, 0); } - av_free(strings); + av_bprint_finalize(&strings, NULL); } if (avio_feof(pb)) return -1; -- 2.54.0 From 0999a6f2ee171059916f79921a19a376d1d6c419 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <[email protected]> Date: Thu, 29 Oct 2026 21:56:57 +0100 Subject: [PATCH 2/3] avformat/vividas: allocate the SB entries per block MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit track_index() allocated entries for the largest packet count in the index, up to INT_MAX, before any block was read. Allocate them in load_sb_block() for the loaded block and return its errors to the header, packet and seek callbacks, and skip a block that declares more packets than fit in it, as each entry takes at least two bytes. Fixes: OOM Fixes: clusterfuzz-testcase-fuzzer_protocol_lavf-6404424499789824 Found-by: https://github.com/google/oss-fuzz/tree/master/projects/mpv Signed-off-by: Kacper Michajłow <[email protected]> (cherry picked from commit c1ef5ecd6db67c7723bf99bf6fa40a88d8a0aac5) --- libavformat/vividas.c | 43 ++++++++++++++++++++++++++++--------------- 1 file changed, 28 insertions(+), 15 deletions(-) diff --git a/libavformat/vividas.c b/libavformat/vividas.c index 5584b04c0c0..ba789f8aa82 100644 --- a/libavformat/vividas.c +++ b/libavformat/vividas.c @@ -440,7 +440,6 @@ static int track_index(VividasDemuxContext *viv, AVFormatContext *s, { int64_t off; int64_t poff; - int maxnp=0; FFIOContext pb0; AVIOContext *const pb = &pb0.pub; int i; @@ -478,25 +477,18 @@ static int track_index(VividasDemuxContext *viv, AVFormatContext *s, off += viv->sb_blocks[i].size; poff += viv->sb_blocks[i].n_packets; - - if (maxnp < viv->sb_blocks[i].n_packets) - maxnp = viv->sb_blocks[i].n_packets; } if (filesize > 0 && poff > filesize) return AVERROR_INVALIDDATA; - viv->sb_entries = av_calloc(maxnp, sizeof(VIV_SB_entry)); - if (!viv->sb_entries) - return AVERROR(ENOMEM); - return 0; } -static void load_sb_block(AVFormatContext *s, VividasDemuxContext *viv, unsigned expected_size) +static int load_sb_block(AVFormatContext *s, VividasDemuxContext *viv, unsigned expected_size) { uint32_t size = 0; - int i; + int i, ret; AVIOContext *pb = 0; if (viv->sb_pb) { @@ -509,12 +501,12 @@ static void load_sb_block(AVFormatContext *s, VividasDemuxContext *viv, unsigned viv->sb_buf = read_sb_block(s->pb, &size, &viv->sb_key, expected_size); if (!viv->sb_buf) { - return; + return AVERROR_INVALIDDATA; } pb = avio_alloc_context(viv->sb_buf, size, 0, NULL, NULL, NULL, NULL); if (!pb) - return; + return AVERROR(ENOMEM); viv->sb_pb = pb; @@ -526,6 +518,18 @@ static void load_sb_block(AVFormatContext *s, VividasDemuxContext *viv, unsigned viv->n_sb_entries = viv->sb_blocks[viv->current_sb].n_packets; + // Each entry takes at least two bytes of the block. + if (viv->n_sb_entries > size / 2) { + viv->n_sb_entries = 0; + return 0; + } + ret = av_reallocp_array(&viv->sb_entries, viv->n_sb_entries, + sizeof(*viv->sb_entries)); + if (ret < 0) { + viv->n_sb_entries = 0; + return ret; + } + for (i = 0; i < viv->n_sb_entries; i++) { viv->sb_entries[i].size = ffio_read_varlen(pb); viv->sb_entries[i].flag = avio_r8(pb); @@ -535,6 +539,8 @@ static void load_sb_block(AVFormatContext *s, VividasDemuxContext *viv, unsigned avio_r8(pb); viv->current_sb_entry = 0; + + return 0; } static int viv_read_header(AVFormatContext *s) @@ -628,7 +634,9 @@ static int viv_read_header(AVFormatContext *s) viv->sb_offset = avio_tell(pb); if (viv->n_sb_blocks > 0) { viv->current_sb = 0; - load_sb_block(s, viv, viv->sb_blocks[0].size); + ret = load_sb_block(s, viv, viv->sb_blocks[0].size); + if (ret < 0) + return ret; } else { viv->current_sb = -1; } @@ -675,7 +683,9 @@ static int viv_read_packet(AVFormatContext *s, return AVERROR_INVALIDDATA; viv->current_sb++; - load_sb_block(s, viv, 0); + ret = load_sb_block(s, viv, 0); + if (ret < 0) + return ret; viv->current_sb_entry = 0; } @@ -766,6 +776,7 @@ static int viv_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp { VividasDemuxContext *viv = s->priv_data; int64_t frame; + int ret; if (stream_index == 0) frame = timestamp; @@ -778,7 +789,9 @@ static int viv_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp // seek to ith sb block avio_seek(s->pb, viv->sb_offset + viv->sb_blocks[i].byte_offset, SEEK_SET); // load the block - load_sb_block(s, viv, 0); + ret = load_sb_block(s, viv, 0); + if (ret < 0) + return ret; if (viv->num_audio) { const AVCodecParameters *par = s->streams[1]->codecpar; // flush audio packet queue -- 2.54.0 From a5f77d76f4167ea908e534acb4afdbaf8c5c9a76 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <[email protected]> Date: Thu, 29 Oct 2026 22:51:19 +0100 Subject: [PATCH 3/3] avcodec/hdrdec: avoid an integer overflow in the input size check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes: signed integer overflow: 701411834 * 4 cannot be represented in type 'int' Fixes: 536328675/clusterfuzz-testcase-minimized-fuzzer_loadfile-4748225916239872 Found-by: https://github.com/google/oss-fuzz/tree/master/projects/mpv Signed-off-by: Kacper Michajłow <[email protected]> (cherry picked from commit c599ac23c8397a0b64f9f1296f1f0584f08a5e2b) --- libavcodec/hdrdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c index 1a6935ff757..3ede2356b1f 100644 --- a/libavcodec/hdrdec.c +++ b/libavcodec/hdrdec.c @@ -126,7 +126,7 @@ static int hdr_decode_frame(AVCodecContext *avctx, AVFrame *p, ; } - if (bytestream2_get_bytes_left(&gb) < height * 4) + if (bytestream2_get_bytes_left(&gb) < height * 4LL) return AVERROR_INVALIDDATA; if ((ret = ff_set_dimensions(avctx, width, height)) < 0) -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
