Backport of upstream commit 61e73851a33f0b4cb7662f8578a4695e77bd3c19 for CVE-2023-51796 to release/5.0.
The release/5.0 branch is still affected by CVE-2023-51796. The upstream patch does not apply cleanly due to code differences, so this patch manually adapts the fix while preserving the original logic. A crafted input can trigger a heap-buffer-overflow in areverse_request_frame() in libavfilter/f_reverse.c. The issue is caused by modifying the `nb_samples` without ensuring that there are enough samples to perform the operation, which may lead to out-of-bounds memory access. This patch fixes the issue by adding a check to ensure that the operation on `nb_samples` only happens when `nb_frames > 1`, preventing buffer overflow. Reproducer triggers a crash before the patch is applied, and works as expected after applying the patch. Associated issue: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/22777 Fix #22777 CVE: CVE-2023-51796 Found-by: Zeng Yunxiang Signed-off-by: lizhixuan.HUST <[email protected]> --- libavfilter/f_reverse.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavfilter/f_reverse.c b/libavfilter/f_reverse.c index f7a7e716fa..d39b7b2428 100644 --- a/libavfilter/f_reverse.c +++ b/libavfilter/f_reverse.c @@ -251,7 +251,8 @@ static int areverse_request_frame(AVFilterLink *outlink) if (ret == AVERROR_EOF && s->nb_frames > 0) { AVFrame *out = s->frames[s->nb_frames - 1]; out->pts = s->pts[s->flush_idx++] - s->nb_samples; - s->nb_samples += s->pts[s->flush_idx] - s->pts[s->flush_idx - 1] - out->nb_samples; + if (s->nb_frames > 1) + s->nb_samples += s->pts[s->flush_idx] - s->pts[s->flush_idx - 1] - out->nb_samples; if (av_sample_fmt_is_planar(out->format)) reverse_samples_planar(out); -- 2.34.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
