PR #24378 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24378 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24378.patch
3 patches which harden and fix related OOM issues >From 1b2e5aa447b554e5dc234fa3d8a600c4c84dae45 Mon Sep 17 00:00:00 2001 From: He Huang <[email protected]> Date: Sat, 5 Sep 2026 02:47:31 +0200 Subject: [PATCH 1/3] avformat/mov: bound the keys atom entry count by the atom size mov_read_keys() allocated (count + 1) pointers from the 32 bit entry count of the keys atom before reading a single key record, so a 56 byte file declaring 16777216 keys made ffprobe allocate and zero 128 MiB. Every key record takes at least 8 bytes, so a count above atom.size / 8 cannot be satisfied and is rejected before the allocation. Fixes: unbounded allocation Fixes: poc-keys-count-16777216.mp4 Fixes: hKO4f7GYoUd0 Found-by: He Huang, discovery assisted by NexusSan Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 1255de95e8..807c804842 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -5728,7 +5728,7 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_skip(pb, 4); count = avio_rb32(pb); atom.size -= 8; - if (count >= UINT_MAX / sizeof(*c->meta_keys)) { + if (count > atom.size / 8 || count >= UINT_MAX / sizeof(*c->meta_keys)) { av_log(c->fc, AV_LOG_ERROR, "The 'keys' atom with the invalid key count: %"PRIu32"\n", count); return AVERROR_INVALIDDATA; -- 2.52.0 >From 0253cb1c396d8e60537315999980324bdae5ca20 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 5 Sep 2026 23:07:24 +0200 Subject: [PATCH 2/3] avformat/mov: Allocate the array without clearing before read Fixes: OOM Fixes: poc-keys-count-16777216-inflated-sizes.mp4 Fixes: hKO4f7GYoUd0 --- libavformat/mov.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 807c804842..6d82a7288d 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -5734,14 +5734,17 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR_INVALIDDATA; } - c->meta_keys_count = count + 1; - c->meta_keys = av_mallocz(c->meta_keys_count * sizeof(*c->meta_keys)); + c->meta_keys = av_malloc_array(count + 1, sizeof(*c->meta_keys)); if (!c->meta_keys) return AVERROR(ENOMEM); + c->meta_keys[0] = NULL; + c->meta_keys_count = 1; for (i = 1; i <= count; ++i) { uint32_t key_size = avio_rb32(pb); uint32_t type = avio_rl32(pb); + c->meta_keys[i] = NULL; + c->meta_keys_count = i + 1; if (key_size < 8 || key_size > atom.size) { av_log(c->fc, AV_LOG_ERROR, "The key# %"PRIu32" in meta has invalid size:" -- 2.52.0 >From 5bd888516fdd575a189abea07e1c3e75cab60e09 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 5 Sep 2026 23:27:34 +0200 Subject: [PATCH 3/3] avformat/mov: do not zero a key string before reading it Fixes: OOM Fixes: poc-keys-bigkey-256M.mp4 Fixes: hKO4f7GYoUd0 --- libavformat/mov.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 6d82a7288d..5523c87c45 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -5757,10 +5757,13 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_skip(pb, key_size); continue; } - c->meta_keys[i] = av_mallocz(key_size + 1); + c->meta_keys[i] = av_malloc(key_size + 1); if (!c->meta_keys[i]) return AVERROR(ENOMEM); - avio_read(pb, c->meta_keys[i], key_size); + int ret = ffio_read_size(pb, c->meta_keys[i], key_size); + if (ret < 0) + return ret; + c->meta_keys[i][key_size] = 0; } return 0; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
