PR #24464 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24464 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24464.patch
Fixes: use of uninitialized memory Fixes: poc.flv Fixes: XQjkQVM5MO3V Found-by: Umar Pathan (Umar0x) >From 8c1e243dc0a3e283fe93727a8e1b2ef8932277ab Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 13 Sep 2026 02:18:21 +0200 Subject: [PATCH 1/2] avcodec/flashsv: keep the bit reader in sync when a block fails to decode --- libavcodec/flashsv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/flashsv.c b/libavcodec/flashsv.c index ba5c995006..5a88cc5077 100644 --- a/libavcodec/flashsv.c +++ b/libavcodec/flashsv.c @@ -263,7 +263,6 @@ static int flashsv_decode_block(AVCodecContext *avctx, const AVPacket *avpkt, return ret; } } - skip_bits_long(gb, 8 * block_size); /* skip the consumed bits */ return 0; } @@ -475,6 +474,7 @@ static int flashsv_decode_frame(AVCodecContext *avctx, AVFrame *rframe, i + j * (h_blocks + !!h_part))) av_log(avctx, AV_LOG_ERROR, "error in decompression of block %dx%d\n", i, j); + skip_bits_long(&gb, 8 * size); } } } -- 2.52.0 >From 6c126368b3824172db215da926ed2dfa96898427 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 13 Sep 2026 02:33:31 +0200 Subject: [PATCH 2/2] avcodec/flashsv: reject blocks whose inflate output is shorter than the block Fixes: use of uninitialized memory Fixes: poc.flv Fixes: XQjkQVM5MO3V Found-by: Umar Pathan (Umar0x) --- libavcodec/flashsv.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/libavcodec/flashsv.c b/libavcodec/flashsv.c index 5a88cc5077..85540ed0d8 100644 --- a/libavcodec/flashsv.c +++ b/libavcodec/flashsv.c @@ -227,11 +227,7 @@ static int flashsv_decode_block(AVCodecContext *avctx, const AVPacket *avpkt, if (ret == Z_DATA_ERROR) { av_log(avctx, AV_LOG_ERROR, "Zlib resync occurred\n"); inflateSync(zstream); - ret = inflate(zstream, Z_FINISH); - } - - if (ret != Z_OK && ret != Z_STREAM_END) { - //return -1; + inflate(zstream, Z_FINISH); } if (s->is_keyframe) { @@ -242,6 +238,13 @@ static int flashsv_decode_block(AVCodecContext *avctx, const AVPacket *avpkt, y_pos += s->diff_start; if (!s->color_depth) { + int inflated = s->block_size * 3 - zstream->avail_out; + + if (inflated < width * 3 * s->diff_height) { + av_log(avctx, AV_LOG_ERROR, "Inflated %d bytes, but %d are needed\n", + inflated, width * 3 * s->diff_height); + return AVERROR_INVALIDDATA; + } /* Flash Screen Video stores the image upside down, so copy * lines to destination in reverse order. */ for (k = 1; k <= s->diff_height; k++) { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
