Backport of upstream commit b1942734c7cbcdc9034034373abcc9ecb9644c47 for CVE-2023-50007 to release/5.0.
The release/5.0 branch is still affected by CVE-2023-50007. The upstream patch does not apply cleanly due to code differences, so this patch manually adapts the fix while preserving the original logic. A crafted input can trigger a negative-size-param bug in av_samples_set_silence() in libavutil/samplefmt.c. The issue is caused by improper handling of the size parameter in the av_samples_set_silence function, which can lead to undefined behavior or crashes. This patch fixes the issue by ensuring that the size parameter is non-negative before being used in the function, preventing invalid memory operations. Fix #22775. Reproducer triggers a crash before the patch is applied, and works as expected after applying the patch. Associated issue: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/22775 Fix #22775 CVE: CVE-2023-50007 Found-by: Zeng Yunxiang Signed-off-by: lizhixuan.HUST <[email protected]> --- libavfilter/af_afwtdn.c | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/libavfilter/af_afwtdn.c b/libavfilter/af_afwtdn.c index 09b504d634..1839190736 100644 --- a/libavfilter/af_afwtdn.c +++ b/libavfilter/af_afwtdn.c @@ -410,6 +410,7 @@ typedef struct AudioFWTDNContext { uint64_t sn; int64_t eof_pts; + int eof; int wavelet_type; int channels; @@ -1071,7 +1072,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) s->drop_samples = 0; } else { if (s->padd_samples < 0 && eof) { - out->nb_samples += s->padd_samples; + out->nb_samples = FFMAX(0, out->nb_samples + s->padd_samples); s->padd_samples = 0; } if (!eof) @@ -1210,23 +1211,26 @@ static int activate(AVFilterContext *ctx) FF_FILTER_FORWARD_STATUS_BACK(outlink, inlink); - ret = ff_inlink_consume_samples(inlink, s->nb_samples, s->nb_samples, &in); - if (ret < 0) - return ret; - if (ret > 0) - return filter_frame(inlink, in); + if (!s->eof) { + ret = ff_inlink_consume_samples(inlink, s->nb_samples, s->nb_samples, &in); + if (ret < 0) + return ret; + if (ret > 0) + return filter_frame(inlink, in); + } if (ff_inlink_acknowledge_status(inlink, &status, &pts)) { - if (status == AVERROR_EOF) { - while (s->padd_samples != 0) { - ret = filter_frame(inlink, NULL); - if (ret < 0) - return ret; - } - ff_outlink_set_status(outlink, status, pts); - return ret; - } + if (status == AVERROR_EOF) + s->eof = 1; } + + if (s->eof && s->padd_samples != 0) { + return filter_frame(inlink, NULL); + } else if (s->eof) { + ff_outlink_set_status(outlink, AVERROR_EOF, s->eof_pts); + return 0; + } + FF_FILTER_FORWARD_WANTED(outlink, inlink); return FFERROR_NOT_READY; -- 2.34.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
