Backport of upstream commit 5f87a68cf70dafeab2fb89b42e41a4c29053b89b for CVE-2023-50008 to release/5.0.
The release/5.0 branch is still affected by CVE-2023-50008. The upstream patch does not apply cleanly due to code differences, so this patch manually adapts the fix while preserving the original logic. A crafted input can trigger memory leaks in the colorcorrect filter. The issue is caused by improper memory deallocation in the uninit function. This patch fixes the issue by ensuring proper deallocation of all allocated memory, specifically freeing the `uhistogram` and `vhistogram` buffers that were previously missing from the `av_freep` call. Reproducer triggers memory consumption before the patch is applied, and works as expected after applying the patch. Associated issue: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/22776 Fix #22776 CVE: CVE-2023-50008 Found-by: Zeng Yunxiang Signed-off-by: lizhixuan.HUST <[email protected]> --- libavfilter/vf_colorcorrect.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavfilter/vf_colorcorrect.c b/libavfilter/vf_colorcorrect.c index ee97b62b0e..ac2de2a357 100644 --- a/libavfilter/vf_colorcorrect.c +++ b/libavfilter/vf_colorcorrect.c @@ -498,6 +498,8 @@ static av_cold void uninit(AVFilterContext *ctx) ColorCorrectContext *s = ctx->priv; av_freep(&s->analyzeret); + av_freep(&s->uhistogram); + av_freep(&s->vhistogram); } static const AVFilterPad colorcorrect_inputs[] = { -- 2.34.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
