PR #24756 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24756 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24756.patch
Fixes: heap-buffer-overflow Fixes: signed integer overflow Fixes: WY5AA7zfuNDv Found-by: Hongduo Zhao >From 854a62af007fa50c2204a262803bd1927dcade1c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 26 Sep 2026 04:21:45 +0200 Subject: [PATCH 1/2] avfilter/vsrc_life: factor the grid allocation out of both init paths --- libavfilter/vsrc_life.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/libavfilter/vsrc_life.c b/libavfilter/vsrc_life.c index aa1fafe674..1a5a1408d5 100644 --- a/libavfilter/vsrc_life.c +++ b/libavfilter/vsrc_life.c @@ -212,6 +212,19 @@ static void fill_picture_rgb(AVFilterContext *ctx, AVFrame *picref) } } +static int alloc_grid(AVFilterContext *ctx) +{ + LifeContext *life = ctx->priv; + + if (!(life->buf[0] = av_calloc(life->h * life->w, sizeof(*life->buf[0]))) || + !(life->buf[1] = av_calloc(life->h * life->w, sizeof(*life->buf[1])))) { + av_freep(&life->buf[0]); + av_freep(&life->buf[1]); + return AVERROR(ENOMEM); + } + return 0; +} + static int init_pattern_from_file(AVFilterContext *ctx) { LifeContext *life = ctx->priv; @@ -247,12 +260,8 @@ static int init_pattern_from_file(AVFilterContext *ctx) life->h = h; } - if (!(life->buf[0] = av_calloc(life->h * life->w, sizeof(*life->buf[0]))) || - !(life->buf[1] = av_calloc(life->h * life->w, sizeof(*life->buf[1])))) { - av_freep(&life->buf[0]); - av_freep(&life->buf[1]); - return AVERROR(ENOMEM); - } + if ((ret = alloc_grid(ctx)) < 0) + return ret; /* fill buf[0] */ p = life->file_buf; @@ -289,12 +298,8 @@ static av_cold int init(AVFilterContext *ctx) /* fill the grid randomly */ int i; - if (!(life->buf[0] = av_calloc(life->h * life->w, sizeof(*life->buf[0]))) || - !(life->buf[1] = av_calloc(life->h * life->w, sizeof(*life->buf[1])))) { - av_freep(&life->buf[0]); - av_freep(&life->buf[1]); - return AVERROR(ENOMEM); - } + if ((ret = alloc_grid(ctx)) < 0) + return ret; if (life->random_seed == -1) life->random_seed = av_get_random_seed(); -- 2.52.0 >From 38d0ed211e327227a074893769153c43820f0852 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 26 Sep 2026 04:24:42 +0200 Subject: [PATCH 2/2] avfilter/vsrc_life: reject grids whose cell count does not fit in an int Fixes: heap-buffer-overflow Fixes: signed integer overflow Fixes: WY5AA7zfuNDv Found-by: Hongduo Zhao --- libavfilter/vsrc_life.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavfilter/vsrc_life.c b/libavfilter/vsrc_life.c index 1a5a1408d5..e99e268b8d 100644 --- a/libavfilter/vsrc_life.c +++ b/libavfilter/vsrc_life.c @@ -26,6 +26,7 @@ /* #define DEBUG */ #include "libavutil/file.h" +#include "libavutil/imgutils.h" #include "libavutil/internal.h" #include "libavutil/intreadwrite.h" #include "libavutil/lfg.h" @@ -215,7 +216,10 @@ static void fill_picture_rgb(AVFilterContext *ctx, AVFrame *picref) static int alloc_grid(AVFilterContext *ctx) { LifeContext *life = ctx->priv; + int ret = av_image_check_size(life->w, life->h, 0, ctx); + if (ret < 0) + return ret; if (!(life->buf[0] = av_calloc(life->h * life->w, sizeof(*life->buf[0]))) || !(life->buf[1] = av_calloc(life->h * life->w, sizeof(*life->buf[1])))) { av_freep(&life->buf[0]); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
