PR #22988 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988.patch

Reported-by: Kenan Alghythee <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>


>From f3c92329e9291999542664b76a6500927a78b43b Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Fri, 1 May 2026 18:40:00 +0200
Subject: [PATCH 1/2] avcodec/wmaenc: Fix missing padding in extradata

Reported-by: Kenan Alghythee <[email protected]>
---
 libavcodec/wmaenc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/wmaenc.c b/libavcodec/wmaenc.c
index b419694c51..35a3c6f6e3 100644
--- a/libavcodec/wmaenc.c
+++ b/libavcodec/wmaenc.c
@@ -65,14 +65,14 @@ static av_cold int encode_init(AVCodecContext *avctx)
     flags1 = 0;
     flags2 = 1;
     if (avctx->codec->id == AV_CODEC_ID_WMAV1) {
-        extradata             = av_malloc(4);
+        extradata             = av_mallocz(4 + AV_INPUT_BUFFER_PADDING_SIZE);
         if (!extradata)
             return AVERROR(ENOMEM);
         avctx->extradata_size = 4;
         AV_WL16(extradata, flags1);
         AV_WL16(extradata + 2, flags2);
     } else if (avctx->codec->id == AV_CODEC_ID_WMAV2) {
-        extradata             = av_mallocz(10);
+        extradata             = av_mallocz(10 + AV_INPUT_BUFFER_PADDING_SIZE);
         if (!extradata)
             return AVERROR(ENOMEM);
         avctx->extradata_size = 10;
-- 
2.52.0


>From f9590d2b1119bd430b735b64e75281c463d957e6 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Fri, 1 May 2026 18:42:48 +0200
Subject: [PATCH 2/2] avformat: Fix various extradata padding issues

Reported-by: Kenan Alghythee <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavformat/iamf_parse.c  |  8 ++++----
 libavformat/iamf_writer.c | 11 ++++++++---
 libavformat/mov.c         |  7 +++----
 3 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 926b17e23f..869872e2c9 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -38,10 +38,10 @@ static int opus_decoder_config(IAMFCodecConfig 
*codec_config,
 {
     int ret, left = len - avio_tell(pb);
 
-    if (left < 11 || codec_config->audio_roll_distance >= 0)
+    if (left < 11 || codec_config->audio_roll_distance >= 0 || left > INT_MAX 
- 8 - AV_INPUT_BUFFER_PADDING_SIZE)
         return AVERROR_INVALIDDATA;
 
-    codec_config->extradata = av_malloc(left + 8);
+    codec_config->extradata = av_mallocz(left + 8 + 
AV_INPUT_BUFFER_PADDING_SIZE);
     if (!codec_config->extradata)
         return AVERROR(ENOMEM);
 
@@ -125,10 +125,10 @@ static int flac_decoder_config(IAMFCodecConfig 
*codec_config,
     avio_skip(pb, 4); // METADATA_BLOCK_HEADER
 
     left = len - avio_tell(pb);
-    if (left < FLAC_STREAMINFO_SIZE)
+    if (left < FLAC_STREAMINFO_SIZE || left > INT_MAX - 
AV_INPUT_BUFFER_PADDING_SIZE)
         return AVERROR_INVALIDDATA;
 
-    codec_config->extradata = av_malloc(left);
+    codec_config->extradata = av_mallocz(left + AV_INPUT_BUFFER_PADDING_SIZE);
     if (!codec_config->extradata)
         return AVERROR(ENOMEM);
 
diff --git a/libavformat/iamf_writer.c b/libavformat/iamf_writer.c
index fcf7929830..e03fc0c4fe 100644
--- a/libavformat/iamf_writer.c
+++ b/libavformat/iamf_writer.c
@@ -126,9 +126,13 @@ static int fill_codec_config(IAMFContext *iamf, const 
AVStreamGroup *stg,
     }
     populate_audio_roll_distance(codec_config);
     if (st->codecpar->extradata_size) {
-        codec_config->extradata = av_memdup(st->codecpar->extradata, 
st->codecpar->extradata_size);
+        if (st->codecpar->extradata_size > INT_MAX - 
AV_INPUT_BUFFER_PADDING_SIZE)
+            return AVERROR_INVALIDDATA;
+
+        codec_config->extradata = av_mallocz(st->codecpar->extradata_size + 
AV_INPUT_BUFFER_PADDING_SIZE);
         if (!codec_config->extradata)
             return AVERROR(ENOMEM);
+        memcpy(codec_config->extradata, st->codecpar->extradata, 
st->codecpar->extradata_size);
         codec_config->extradata_size = st->codecpar->extradata_size;
         ret = update_extradata(codec_config);
         if (ret < 0)
@@ -1237,15 +1241,16 @@ int ff_iamf_write_audio_frame(const IAMFContext *iamf, 
AVIOContext *pb,
                                                                
AV_PKT_DATA_NEW_EXTRADATA,
                                                                
&new_extradata_size);
 
-        if (!new_extradata)
+        if (!new_extradata || new_extradata_size > INT_MAX - 
AV_INPUT_BUFFER_PADDING_SIZE)
             return AVERROR_INVALIDDATA;
 
         av_free(codec_config->extradata);
-        codec_config->extradata = av_memdup(new_extradata, new_extradata_size);
+        codec_config->extradata = av_mallocz(new_extradata_size + 
AV_INPUT_BUFFER_PADDING_SIZE);
         if (!codec_config->extradata) {
             codec_config->extradata_size = 0;
             return AVERROR(ENOMEM);
         }
+        memcpy(codec_config->extradata, new_extradata, new_extradata_size);
         codec_config->extradata_size = new_extradata_size;
 
         return update_extradata(codec_config);
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 12fb00be59..9730d56614 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -932,10 +932,9 @@ static int mov_read_iacb(MOVContext *c, AVIOContext *pb, 
MOVAtom atom)
         return AVERROR(ENOMEM);
     iamf = &sc->iamf->iamf;
 
-    st->codecpar->extradata = av_malloc(descriptors_size);
-    if (!st->codecpar->extradata)
-        return AVERROR(ENOMEM);
-    st->codecpar->extradata_size = descriptors_size;
+    ret = ff_alloc_extradata(st->codecpar, descriptors_size);
+    if (ret < 0)
+        return ret;
 
     ret = avio_read(pb, st->codecpar->extradata, descriptors_size);
     if (ret != descriptors_size)
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to