PR #20513 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20513 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20513.patch
avcodec/exif: Use av_fast_mallocz() in av_exif_clone_ifd() using fast realloc leaves the entries uninitialized and frees garbage pointers on errors >From f4cfb976540b4eaed69873b6168ebc331b8923b2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 13 Sep 2025 13:53:53 +0200 Subject: [PATCH 1/2] avcodec/exif: Do not leave uninitialized pointers on errors in exif_clone_entry() No testcase, but this looks like it could free garbage pointers Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/exif.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/exif.c b/libavcodec/exif.c index f9ad3e1bdb..3e86833986 100644 --- a/libavcodec/exif.c +++ b/libavcodec/exif.c @@ -953,6 +953,7 @@ static int exif_clone_entry(AVExifEntry *dst, const AVExifEntry *src) dst->count = src->count; dst->id = src->id; dst->type = src->type; + memset(&dst->value, 0, sizeof(dst->value)); dst->ifd_offset = src->ifd_offset; if (src->ifd_lead) { -- 2.49.1 >From 2e8cc7b86019fb32bdf0b23a138901e6f65238f5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 13 Sep 2025 14:00:55 +0200 Subject: [PATCH 2/2] avcodec/exif: Use av_fast_mallocz() in av_exif_clone_ifd() using fast realloc leaves the entries uninitialized and frees garbage pointers on errors Fixes: bug_triggering_file Found-by: *2ourc3, 5pider Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/exif.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/exif.c b/libavcodec/exif.c index 3e86833986..cd6c0c3771 100644 --- a/libavcodec/exif.c +++ b/libavcodec/exif.c @@ -1152,7 +1152,7 @@ AVExifMetadata *av_exif_clone_ifd(const AVExifMetadata *ifd) size_t required_size; if (av_size_mult(ret->count, sizeof(*ret->entries), &required_size) < 0) goto fail; - ret->entries = av_fast_realloc(NULL, &ret->size, required_size); + av_fast_mallocz(&ret->entries, &ret->size, required_size); if (!ret->entries) goto fail; } -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
