PR #24495 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24495 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24495.patch
decode_cell() read the descriptor byte before comparing against last_ptr, so a bit tree that ran out of data took the mode and VQ index of its last cell from the byte after the plane. That read is bounded: next_cell_data comes either from the bit position, which the checked bit reader clamps to 8 bits past the end of the plane, or from a completed cell, whose reads all lie before last_ptr. So the descriptor is read at most 2 bytes past the plane, the plane ends at or before the packet, and the read stays inside the packet padding. This is not an out of array access, the cell was just decoded from a byte that does not belong to its plane. Found-by: zhang xingxing Signed-off-by: Michael Niedermayer <[email protected]> >From 94727eaae993790e3e83878004c6c21ddef9c9b6 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 15 Sep 2026 05:14:11 +0200 Subject: [PATCH] avcodec/indeo3: check that the VQ descriptor byte lies within the plane data decode_cell() read the descriptor byte before comparing against last_ptr, so a bit tree that ran out of data took the mode and VQ index of its last cell from the byte after the plane. That read is bounded: next_cell_data comes either from the bit position, which the checked bit reader clamps to 8 bits past the end of the plane, or from a completed cell, whose reads all lie before last_ptr. So the descriptor is read at most 2 bytes past the plane, the plane ends at or before the packet, and the read stays inside the packet padding. This is not an out of array access, the cell was just decoded from a byte that does not belong to its plane. Found-by: zhang xingxing Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/indeo3.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c index fb9f3fba3b..4002b42063 100644 --- a/libavcodec/indeo3.c +++ b/libavcodec/indeo3.c @@ -594,6 +594,11 @@ static int decode_cell(Indeo3DecodeContext *ctx, AVCodecContext *avctx, const vqEntry *delta[2]; const uint8_t *data_start = data_ptr; + if (data_ptr >= last_ptr) { + av_log(avctx, AV_LOG_ERROR, "attempt to read past end of buffer\n"); + return AVERROR_INVALIDDATA; + } + /* get coding mode and VQ table index from the VQ descriptor byte */ code = *data_ptr++; mode = code >> 4; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
