PR #25798 opened by Marti2203
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25798
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25798.patch
`parse_rule()` dispatches on `strchr("bBsS", *p)`. `strchr()` also matches the
terminating NUL, so for an empty rule string the Born/Stay branch is entered
on the NUL byte, `p` is advanced past it, and the digit loop then reads one
byte past the end of the rule buffer:
ffmpeg -f lavfi -i "life=rule=:s=64x64" -frames:v 1 -f null -
reports a heap-buffer-overflow READ in `parse_rule()` under AddressSanitizer
(`life=rule=b/` triggers the same path via the trailing-slash loop).
The patch guards both `strchr()` tests with an explicit non-NUL check, so an
empty rule falls through to the numeric parser (rule 0) instead of running off
the end of the string. Valid rules (default, `B3/S23`, numeric) and the
`fate-filter-lavd-life` test are unaffected.
The issue was found with an LLM-assisted static analysis tool and verified
manually.
>From 6a01abcbd7585d2461edafe5c2bd4545f5aa9794 Mon Sep 17 00:00:00 2001
From: Martin Mirchev <[email protected]>
Date: Fri, 6 Nov 2026 11:41:05 +0800
Subject: [PATCH] avfilter/vsrc_life: fix out-of-bounds read for an empty rule
parse_rule() dispatches on strchr("bBsS", *p). strchr() also matches the
terminating NUL, so for an empty rule string (life=rule= or life=rule=b/)
the "Born/Stay" branch is entered on the NUL, p is advanced past it, and
the digit loop then reads one byte past the end of the rule buffer.
ffmpeg -f lavfi -i "life=rule=:s=64x64" -frames:v 1 -f null -
reports a heap-buffer-overflow READ in parse_rule() under ASan.
Guard both strchr() tests with an explicit non-NUL check so an empty rule
falls through to the numeric parser (rule 0) instead of running off the
end of the string.
Found with an LLM-assisted static analysis tool and verified manually.
Signed-off-by: Martin Mirchev <[email protected]>
---
libavfilter/vsrc_life.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavfilter/vsrc_life.c b/libavfilter/vsrc_life.c
index db8750f4697..64db131d824 100644
--- a/libavfilter/vsrc_life.c
+++ b/libavfilter/vsrc_life.c
@@ -107,7 +107,7 @@ static int parse_rule(uint16_t *born_rule, uint16_t
*stay_rule,
*born_rule = 0;
*stay_rule = 0;
- if (strchr("bBsS", *p)) {
+ if (*p && strchr("bBsS", *p)) {
/* parse rule as a Born / Stay Alive code, see
* http://en.wikipedia.org/wiki/Conway%27s_Game_of_Life */
do {
@@ -120,7 +120,7 @@ static int parse_rule(uint16_t *born_rule, uint16_t
*stay_rule,
if (*p != '/')
break;
p++;
- } while (strchr("bBsS", *p));
+ } while (*p && strchr("bBsS", *p));
if (*p)
goto error;
--
2.54.0
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
