PR #25801 opened by Marti2203
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25801
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25801.patch
`decode_frame()` requires every Fraps v2-v5 plane except the last one to be
larger than the 1024-byte Huffman count table (`offs[i] <= offs[i - 1] + 1024`
is rejected), but the last plane only has to be non-empty.
`fraps2_decode_plane()` always reads the 1024-byte table from the start of the
plane, and the tmpbuf size `offs[i + 1] - offs[i] - 1024` wraps around for a
shorter plane.
With the default `max_alloc` the wrapped size makes the tmpbuf allocation fail,
so such a frame is just rejected with ENOMEM. With a raised limit the
allocation succeeds and the count table is read past the end of the packet; for
a constructed 16x16 file with a 504-byte last plane,
ffmpeg -max_alloc 8589934592 -i short-last-plane.avi -f null -
reports a heap-buffer-overflow read in `fraps2_decode_plane()` under ASan (456
bytes past the packet).
The patch applies the same minimum size to the last plane as to the others.
That also keeps the tmpbuf size positive. The test file is now rejected with
"plane 2 is too small", and fate-fraps (v0-v5) and fate-avio-direct pass.
The issue was found with an LLM-assisted static analysis tool and verified
manually.
>From a7e53d6730e273a38324a580d1046fb1805cd9fd Mon Sep 17 00:00:00 2001
From: Martin Mirchev <[email protected]>
Date: Fri, 6 Nov 2026 11:57:27 +0800
Subject: [PATCH] avcodec/fraps: check the size of the last plane
decode_frame() requires each Fraps v2-v5 plane except the last one to
be larger than the 1024-byte Huffman count table, but the last plane only
has to be non-empty. fraps2_decode_plane() always reads the 1024-byte
table from the start of the plane, and the tmpbuf size
offs[i + 1] - offs[i] - 1024 wraps around for such a plane.
With the default max_alloc the wrapped size makes the tmpbuf allocation
fail and the frame is rejected with ENOMEM. With a raised -max_alloc the
allocation succeeds and the count table is read past the end of the
packet (456 bytes for a 504-byte last plane).
Apply the same minimum size to the last plane as to the others.
Found with an LLM-assisted static analysis tool and verified manually.
Signed-off-by: Martin Mirchev <[email protected]>
---
libavcodec/fraps.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavcodec/fraps.c b/libavcodec/fraps.c
index d7b713c7c4c..3c055af8319 100644
--- a/libavcodec/fraps.c
+++ b/libavcodec/fraps.c
@@ -208,6 +208,10 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *f,
}
}
offs[planes] = buf_size - header_size;
+ if (offs[planes] <= offs[planes - 1] + 1024) {
+ av_log(avctx, AV_LOG_ERROR, "plane %i is too small\n", planes - 1);
+ return AVERROR_INVALIDDATA;
+ }
for (i = 0; i < planes; i++) {
av_fast_padded_malloc(&s->tmpbuf, &s->tmpbuf_size, offs[i + 1] -
offs[i] - 1024);
if (!s->tmpbuf)
--
2.54.0
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
