PR #22988 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988.patch
Reported-by: Kenan Alghythee <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> >From f3c92329e9291999542664b76a6500927a78b43b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 1 May 2026 18:40:00 +0200 Subject: [PATCH 1/2] avcodec/wmaenc: Fix missing padding in extradata Reported-by: Kenan Alghythee <[email protected]> --- libavcodec/wmaenc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/wmaenc.c b/libavcodec/wmaenc.c index b419694c51..35a3c6f6e3 100644 --- a/libavcodec/wmaenc.c +++ b/libavcodec/wmaenc.c @@ -65,14 +65,14 @@ static av_cold int encode_init(AVCodecContext *avctx) flags1 = 0; flags2 = 1; if (avctx->codec->id == AV_CODEC_ID_WMAV1) { - extradata = av_malloc(4); + extradata = av_mallocz(4 + AV_INPUT_BUFFER_PADDING_SIZE); if (!extradata) return AVERROR(ENOMEM); avctx->extradata_size = 4; AV_WL16(extradata, flags1); AV_WL16(extradata + 2, flags2); } else if (avctx->codec->id == AV_CODEC_ID_WMAV2) { - extradata = av_mallocz(10); + extradata = av_mallocz(10 + AV_INPUT_BUFFER_PADDING_SIZE); if (!extradata) return AVERROR(ENOMEM); avctx->extradata_size = 10; -- 2.52.0 >From f9590d2b1119bd430b735b64e75281c463d957e6 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 1 May 2026 18:42:48 +0200 Subject: [PATCH 2/2] avformat: Fix various extradata padding issues Reported-by: Kenan Alghythee <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/iamf_parse.c | 8 ++++---- libavformat/iamf_writer.c | 11 ++++++++--- libavformat/mov.c | 7 +++---- 3 files changed, 15 insertions(+), 11 deletions(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 926b17e23f..869872e2c9 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -38,10 +38,10 @@ static int opus_decoder_config(IAMFCodecConfig *codec_config, { int ret, left = len - avio_tell(pb); - if (left < 11 || codec_config->audio_roll_distance >= 0) + if (left < 11 || codec_config->audio_roll_distance >= 0 || left > INT_MAX - 8 - AV_INPUT_BUFFER_PADDING_SIZE) return AVERROR_INVALIDDATA; - codec_config->extradata = av_malloc(left + 8); + codec_config->extradata = av_mallocz(left + 8 + AV_INPUT_BUFFER_PADDING_SIZE); if (!codec_config->extradata) return AVERROR(ENOMEM); @@ -125,10 +125,10 @@ static int flac_decoder_config(IAMFCodecConfig *codec_config, avio_skip(pb, 4); // METADATA_BLOCK_HEADER left = len - avio_tell(pb); - if (left < FLAC_STREAMINFO_SIZE) + if (left < FLAC_STREAMINFO_SIZE || left > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) return AVERROR_INVALIDDATA; - codec_config->extradata = av_malloc(left); + codec_config->extradata = av_mallocz(left + AV_INPUT_BUFFER_PADDING_SIZE); if (!codec_config->extradata) return AVERROR(ENOMEM); diff --git a/libavformat/iamf_writer.c b/libavformat/iamf_writer.c index fcf7929830..e03fc0c4fe 100644 --- a/libavformat/iamf_writer.c +++ b/libavformat/iamf_writer.c @@ -126,9 +126,13 @@ static int fill_codec_config(IAMFContext *iamf, const AVStreamGroup *stg, } populate_audio_roll_distance(codec_config); if (st->codecpar->extradata_size) { - codec_config->extradata = av_memdup(st->codecpar->extradata, st->codecpar->extradata_size); + if (st->codecpar->extradata_size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) + return AVERROR_INVALIDDATA; + + codec_config->extradata = av_mallocz(st->codecpar->extradata_size + AV_INPUT_BUFFER_PADDING_SIZE); if (!codec_config->extradata) return AVERROR(ENOMEM); + memcpy(codec_config->extradata, st->codecpar->extradata, st->codecpar->extradata_size); codec_config->extradata_size = st->codecpar->extradata_size; ret = update_extradata(codec_config); if (ret < 0) @@ -1237,15 +1241,16 @@ int ff_iamf_write_audio_frame(const IAMFContext *iamf, AVIOContext *pb, AV_PKT_DATA_NEW_EXTRADATA, &new_extradata_size); - if (!new_extradata) + if (!new_extradata || new_extradata_size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) return AVERROR_INVALIDDATA; av_free(codec_config->extradata); - codec_config->extradata = av_memdup(new_extradata, new_extradata_size); + codec_config->extradata = av_mallocz(new_extradata_size + AV_INPUT_BUFFER_PADDING_SIZE); if (!codec_config->extradata) { codec_config->extradata_size = 0; return AVERROR(ENOMEM); } + memcpy(codec_config->extradata, new_extradata, new_extradata_size); codec_config->extradata_size = new_extradata_size; return update_extradata(codec_config); diff --git a/libavformat/mov.c b/libavformat/mov.c index 12fb00be59..9730d56614 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -932,10 +932,9 @@ static int mov_read_iacb(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR(ENOMEM); iamf = &sc->iamf->iamf; - st->codecpar->extradata = av_malloc(descriptors_size); - if (!st->codecpar->extradata) - return AVERROR(ENOMEM); - st->codecpar->extradata_size = descriptors_size; + ret = ff_alloc_extradata(st->codecpar, descriptors_size); + if (ret < 0) + return ret; ret = avio_read(pb, st->codecpar->extradata, descriptors_size); if (ret != descriptors_size) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
