This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new fe47696aa1 avcodec/lzf: pad the decompressed buffer
fe47696aa1 is described below
commit fe47696aa1eb3b4f2359b9c4416c529912deee38
Author: Michael Niedermayer <[email protected]>
AuthorDate: Sun Jul 5 22:55:50 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Tue Jul 7 17:35:58 2026 +0000
avcodec/lzf: pad the decompressed buffer
Fixes: out of array read
Fixes: oddlist.mov / poc.mov
Found-by: Clouditera Security; Z.ai Security; NSFOCUS
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavcodec/lzf.c | 12 ++++++++----
libavcodec/lzf.h | 5 +++++
2 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/libavcodec/lzf.c b/libavcodec/lzf.c
index 5d6e9925d4..1c38c98982 100644
--- a/libavcodec/lzf.c
+++ b/libavcodec/lzf.c
@@ -32,6 +32,7 @@
#include "libavutil/mem.h"
#include "bytestream.h"
+#include "defs.h"
#include "lzf.h"
#define LZF_LITERAL_MAX (1 << 5)
@@ -62,8 +63,8 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf,
size_t *size, unsigned
if (s < LZF_LITERAL_MAX) {
s++;
- if (s > *allocated_size - len) {
- ret = lzf_realloc(buf, len + s, allocated_size);
+ if (s + AV_INPUT_BUFFER_PADDING_SIZE > *allocated_size - len) {
+ ret = lzf_realloc(buf, len + s + AV_INPUT_BUFFER_PADDING_SIZE,
allocated_size);
if (ret < 0)
return ret;
p = *buf + len;
@@ -87,8 +88,8 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf,
size_t *size, unsigned
if (off > len)
return AVERROR_INVALIDDATA;
- if (l > *allocated_size - len) {
- ret = lzf_realloc(buf, len + l, allocated_size);
+ if (l + AV_INPUT_BUFFER_PADDING_SIZE > *allocated_size - len) {
+ ret = lzf_realloc(buf, len + l + AV_INPUT_BUFFER_PADDING_SIZE,
allocated_size);
if (ret < 0)
return ret;
p = *buf + len;
@@ -101,6 +102,9 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf,
size_t *size, unsigned
}
}
+ if (*buf)
+ memset(*buf + len, 0, AV_INPUT_BUFFER_PADDING_SIZE);
+
*size = len;
return 0;
diff --git a/libavcodec/lzf.h b/libavcodec/lzf.h
index e61ebff727..48f99a452c 100644
--- a/libavcodec/lzf.h
+++ b/libavcodec/lzf.h
@@ -24,6 +24,11 @@
#include "bytestream.h"
+/**
+ * Decompress LZF data into *buf, reallocating it as needed.
+ * On success the output is followed by AV_INPUT_BUFFER_PADDING_SIZE
+ * zeroed bytes.
+ */
int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size,
unsigned *allocated_size);
#endif /* AVCODEC_LZF_H */
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
