Backport of upstream commit 50f0f8c53c818f73fe2d752708e2fa9d2a2d8a07 for CVE-2023-51794 to release/5.0.
The release/5.0 branch is still affected by CVE-2023-51794. The upstream patch does not apply cleanly due to code differences, so this patch manually adapts the fix while preserving the original logic. A crafted input can trigger a buffer overflow in libavfilter/af_stereowiden.c, specifically when the `length` variable is set to 0, which leads to memory access issues when allocating the `buffer`. This patch fixes the issue by adding a check to ensure `length` is not zero before attempting memory allocation, preventing invalid memory access. Reproducer triggers a crash before the patch is applied, and works as expected after applying the patch. Associated issue: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/22778 Fix #22778 CVE: CVE-2023-51794 Found-by: Zeng Yunxiang Signed-off-by: lizhixuan.HUST <[email protected]> --- libavfilter/af_stereowiden.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavfilter/af_stereowiden.c b/libavfilter/af_stereowiden.c index 7cce1a8f28..f1a5b108aa 100644 --- a/libavfilter/af_stereowiden.c +++ b/libavfilter/af_stereowiden.c @@ -74,6 +74,8 @@ static int config_input(AVFilterLink *inlink) s->length = s->delay * inlink->sample_rate / 1000; s->length *= 2; + if (s->length == 0) + return AVERROR(EINVAL); s->buffer = av_calloc(s->length, sizeof(*s->buffer)); if (!s->buffer) return AVERROR(ENOMEM); -- 2.34.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
