PR #22995 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22995 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22995.patch
Add a per-block bounds check at the start of each XOR block so the read is rejected before src crosses decomp_len, and propagate the error from decode_frame(). Fixes: out of array read Found-by: Seung Min Shin >From 1364d634304dd53ae925b158f9fbf9ac32048880 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 2 May 2026 11:11:02 +0200 Subject: [PATCH] avcodec/zmbv: reject XOR data that overruns the decompression buffer Add a per-block bounds check at the start of each XOR block so the read is rejected before src crosses decomp_len, and propagate the error from decode_frame(). Fixes: out of array read Found-by: Seung Min Shin --- libavcodec/zmbv.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/libavcodec/zmbv.c b/libavcodec/zmbv.c index 947097bb4a..3e2e7fa98a 100644 --- a/libavcodec/zmbv.c +++ b/libavcodec/zmbv.c @@ -139,6 +139,8 @@ static int zmbv_decode_xor_8(ZmbvContext *c) } if (d) { /* apply XOR'ed difference */ + if (c->decomp_len - (src - c->decomp_buf) < bw2 * bh2) + return AVERROR_INVALIDDATA; out = output + x; for (j = 0; j < bh2; j++) { for (i = 0; i < bw2; i++) @@ -213,6 +215,8 @@ static int zmbv_decode_xor_16(ZmbvContext *c) } if (d) { /* apply XOR'ed difference */ + if (c->decomp_len - (src - c->decomp_buf) < bw2 * bh2 * 2) + return AVERROR_INVALIDDATA; out = output + x; for (j = 0; j < bh2; j++){ for (i = 0; i < bw2; i++) { @@ -297,6 +301,8 @@ static int zmbv_decode_xor_24(ZmbvContext *c) } if (d) { /* apply XOR'ed difference */ + if (c->decomp_len - (src - c->decomp_buf) < bw2 * bh2 * 3) + return AVERROR_INVALIDDATA; out = output + x * 3; for (j = 0; j < bh2; j++) { for (i = 0; i < bw2; i++) { @@ -375,6 +381,8 @@ static int zmbv_decode_xor_32(ZmbvContext *c) } if (d) { /* apply XOR'ed difference */ + if (c->decomp_len - (src - c->decomp_buf) < bw2 * bh2 * 4) + return AVERROR_INVALIDDATA; out = output + x; for (j = 0; j < bh2; j++){ for (i = 0; i < bw2; i++) { @@ -569,8 +577,10 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame, frame->pict_type = AV_PICTURE_TYPE_P; if (c->decomp_len < 2LL * ((c->width + c->bw - 1) / c->bw) * ((c->height + c->bh - 1) / c->bh)) return AVERROR_INVALIDDATA; - if (c->decomp_len) - c->decode_xor(c); + if (c->decomp_len) { + if ((ret = c->decode_xor(c)) < 0) + return ret; + } } /* update frames */ -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
