Backport of upstream commit 96449cfeaeb95fcfd7a2b8d9ccf7719e97471ed1 for CVE-2024-32230 to release/6.0.
The release/6.0 branch is still affected by CVE-2024-32230. The upstream patch does not apply cleanly due to code differences, so this patch manually adapts the fix while preserving the original logic. A crafted input can trigger a negative-size-param buffer overflow in load_input_picture() in libavcodec/mpegvideo_enc.c. The issue is caused by using width and height without proper rounding, which may lead to out-of-bounds memory access. This patch fixes the issue #22764. Reproducer triggers a crash before the patch is applied, and works as expected after applying the patch. Associated issue: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/22764 CVE: CVE-2024-32230 Found-by: Zeng Yunxiang Signed-off-by: lizhixuan.HUST <[email protected]> --- libavcodec/mpegvideo_enc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/mpegvideo_enc.c b/libavcodec/mpegvideo_enc.c index 86a9dd7188..d405f698fe 100644 --- a/libavcodec/mpegvideo_enc.c +++ b/libavcodec/mpegvideo_enc.c @@ -1181,8 +1181,8 @@ static int load_input_picture(MpegEncContext *s, const AVFrame *pic_arg) ptrdiff_t dst_stride = i ? s->uvlinesize : s->linesize; int h_shift = i ? h_chroma_shift : 0; int v_shift = i ? v_chroma_shift : 0; - int w = s->width >> h_shift; - int h = s->height >> v_shift; + int w = AV_CEIL_RSHIFT(s->width , h_shift); + int h = AV_CEIL_RSHIFT(s->height, v_shift); const uint8_t *src = pic_arg->data[i]; uint8_t *dst = pic->f->data[i]; int vpad = 16; -- 2.34.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
