PR #24626 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24626 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24626.patch
Fixes: use of uninitialized memory Fixes: 1x2fnPjXJ7Vn/xan_wc3_uninit_buffer2.mve Fixes: 1x2fnPjXJ7Vn Reporter ID: swarm-Heap-info-leak-via-partially-filled-buffer2-after-xan_unpack-d3f824 Found-by: zhang xingxing <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> >From 03fd43106e5bb17aef735b1c4a3f90b0f395157c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 22 Sep 2026 00:50:26 +0200 Subject: [PATCH] avcodec/xan: use only the bytes xan_unpack() wrote as image data Fixes: use of uninitialized memory Fixes: 1x2fnPjXJ7Vn/xan_wc3_uninit_buffer2.mve Fixes: 1x2fnPjXJ7Vn Reporter ID: swarm-Heap-info-leak-via-partially-filled-buffer2-after-xan_unpack-d3f824 Found-by: zhang xingxing <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/xan.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/libavcodec/xan.c b/libavcodec/xan.c index 56675dbbb1..416e33c420 100644 --- a/libavcodec/xan.c +++ b/libavcodec/xan.c @@ -149,9 +149,10 @@ static int xan_huffman_decode(uint8_t *dest, int dest_len, * unpack simple compression * * @param dest destination buffer of dest_len, must be padded with at least 130 bytes + * @return number of bytes written to dest */ -static void xan_unpack(uint8_t *dest, int dest_len, - const uint8_t *src, int src_len) +static int xan_unpack(uint8_t *dest, int dest_len, + const uint8_t *src, int src_len) { uint8_t opcode; int size; @@ -185,7 +186,7 @@ static void xan_unpack(uint8_t *dest, int dest_len, if (dest_end - dest < size + size2 || dest + size - dest_org < back || bytestream2_get_bytes_left(&ctx) < size) - return; + break; bytestream2_get_buffer(&ctx, dest, size); dest += size; av_memcpy_backptr(dest, back, size2); @@ -195,13 +196,14 @@ static void xan_unpack(uint8_t *dest, int dest_len, size = finish ? opcode & 3 : ((opcode & 0x1f) << 2) + 4; if (dest_end - dest < size || bytestream2_get_bytes_left(&ctx) < size) - return; + break; bytestream2_get_buffer(&ctx, dest, size); dest += size; if (finish) - return; + break; } } + return dest - dest_org; } static inline void xan_wc3_output_pixel_run(XanContext *s, AVFrame *frame, @@ -342,9 +344,8 @@ static int xan_wc3_decode_frame(XanContext *s, AVFrame *frame) opcode_buffer_end = opcode_buffer + ret; if (imagedata_segment[0] == 2) { - xan_unpack(s->buffer2, s->buffer2_size, - &imagedata_segment[1], s->size - imagedata_offset - 1); - imagedata_size = s->buffer2_size; + imagedata_size = xan_unpack(s->buffer2, s->buffer2_size, + &imagedata_segment[1], s->size - imagedata_offset - 1); } else { imagedata_size = s->size - imagedata_offset - 1; imagedata_buffer = &imagedata_segment[1]; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
