PR #25848 opened by romainhedouin URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25848 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25848.patch
A page segment of 1 byte or a CLUT segment of 0 or 1 byte was parsed using the bytes after it, which could make later valid pages or CLUTs be ignored. This PR returns AVERROR_INVALIDDATA like the other segments do. Valid streams are unaffected. Testing: every segment length compared with master, fuzzing with short segments, ASan/UBSan, leaks, DVB FATE tests. Found during a code review sweep of ffmpeg using an LLM. Signed-off-by: romainhedouin <[email protected]> <!-- If this PR requires new FATE test samples, attach them to the PR and list their target paths below (relative to the fate-suite root). Attached filenames must match the sample's filename: ```fate-samples # e.g. vorbis/new-sample.ogg ``` --> >From d78aa407005cb0b633ce6b5360218aa0eef0ba11 Mon Sep 17 00:00:00 2001 From: romainhedouin <[email protected]> Date: Sat, 7 Nov 2026 19:51:11 +0100 Subject: [PATCH] avcodec/dvbsubdec: check the size of page and CLUT segment headers A page segment starts with 2 bytes (time out, then version and state), but only 1 byte was required. The CLUT segment header (id and version) was not checked at all. A shorter segment made the decoder use the bytes after it as the page version and state, or as the CLUT id and version, which could hide a later valid page or CLUT. Return AVERROR_INVALIDDATA like the other segment types. The error is currently swallowed in dvbsub_decode(), so the rest of the packet is dropped. Found during a code review sweep of ffmpeg using an LLM. Signed-off-by: romainhedouin <[email protected]> --- libavcodec/dvbsubdec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/dvbsubdec.c b/libavcodec/dvbsubdec.c index 2426da896d1..6241d3a3719 100644 --- a/libavcodec/dvbsubdec.c +++ b/libavcodec/dvbsubdec.c @@ -1068,6 +1068,9 @@ static int dvbsub_parse_clut_segment(AVCodecContext *avctx, int y, cr, cb, alpha; int r, g, b, r_add, g_add, b_add; + if (buf_size < 2) + return AVERROR_INVALIDDATA; + ff_dlog(avctx, "DVB clut packet:\n"); for (i=0; i < buf_size; i++) { @@ -1313,7 +1316,7 @@ static int dvbsub_parse_page_segment(AVCodecContext *avctx, int timeout; int version; - if (buf_size < 1) + if (buf_size < 2) return AVERROR_INVALIDDATA; timeout = *buf++; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
