PR #24878 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24878 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24878.patch
Move the same range as for index_entries, tts_count is set to nb_index_entries right after. Fixes: out of array access Fixes: crash.mp4 / make-crash.py Fixes: srZp1wXh4CXQ Found-by: OpenAI Security Research Replicated through UnModified FFmpeg Signed-off-by: Michael Niedermayer <[email protected]> >From a17017e09f365e145200b0f6f008651ca7e11280 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 2 Oct 2026 17:53:26 +0200 Subject: [PATCH 1/3] avformat/mov: make room in tts_data by the index entry count in mov_read_trun() Move the same range as for index_entries, tts_count is set to nb_index_entries right after. Fixes: out of array access Fixes: crash.mp4 / make-crash.py Fixes: srZp1wXh4CXQ Found-by: OpenAI Security Research Replicated through UnModified FFmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 71c4e38c88..e3e0100e11 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -6380,7 +6380,7 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom) (sti->nb_index_entries - index_entry_pos)); memmove(sc->tts_data + index_entry_pos + entries, sc->tts_data + index_entry_pos, - sizeof(*sc->tts_data) * (sc->tts_count - index_entry_pos)); + sizeof(*sc->tts_data) * (sti->nb_index_entries - index_entry_pos)); if (index_entry_pos < sc->current_sample) { sc->current_sample += entries; } -- 2.52.0 >From 1fe11ecf66427f72dcc82a64fe4403a9fa67ce82 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 2 Oct 2026 17:53:35 +0200 Subject: [PATCH 2/3] avformat/mov: keep frag_index.current on its fragment in update_frag_index() The assertion failure was found during triage of the security report srZp1wXh4CXQ. Fixes: out of array access Fixes: Assertion index_entry_pos <= sti->nb_index_entries failed Fixes: crash.mp4 / make-crash.py Fixes: variant-assert.mp4 / make-variant-assert.py Fixes: srZp1wXh4CXQ Found-by: OpenAI Security Research Replicated through UnModified FFmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index e3e0100e11..77402ad2ec 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -1917,6 +1917,8 @@ static int update_frag_index(MOVContext *c, int64_t offset) if (index < c->frag_index.nb_items) memmove(c->frag_index.item + index + 1, c->frag_index.item + index, (c->frag_index.nb_items - index) * sizeof(*c->frag_index.item)); + if (index <= c->frag_index.current) + c->frag_index.current++; item = &c->frag_index.item[index]; item->headers_read = 0; -- 2.52.0 >From 144b1965c54a7a55ca12664da799ac42f9af2f9f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 2 Oct 2026 18:02:52 +0200 Subject: [PATCH 3/3] avformat/mov: zero tts_data between tts_count and nb_index_entries in mov_read_trun() Fixes: read of uninitialized memory Fixes: uninit.mp4 / gen-uninit.py Fixes: QcOY0fqViB2h Found during triage of the security report srZp1wXh4CXQ Replicated through UnModified FFmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 77402ad2ec..3a4a777975 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -6210,7 +6210,6 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom) int64_t prev_dts = AV_NOPTS_VALUE; int next_frag_index = -1, index_entry_pos; size_t requested_size; - size_t old_allocated_size; AVIndexEntry *new_entries; MOVFragmentStreamInfo * frag_stream_info; @@ -6361,7 +6360,6 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom) sti->index_entries= new_entries; requested_size = (sti->nb_index_entries + entries) * sizeof(*sc->tts_data); - old_allocated_size = sc->tts_allocated_size; tts_data = av_fast_realloc(sc->tts_data, &sc->tts_allocated_size, requested_size); if (!tts_data) @@ -6371,8 +6369,9 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom) // In case there were samples without time to sample entries, ensure they get // zero valued entries. This ensures clips which mix boxes with and // without time to sample entries don't pickup uninitialized data. - memset((uint8_t*)(sc->tts_data) + old_allocated_size, 0, - sc->tts_allocated_size - old_allocated_size); + if (sc->tts_count < sti->nb_index_entries) + memset(sc->tts_data + sc->tts_count, 0, + sizeof(*sc->tts_data) * (sti->nb_index_entries - sc->tts_count)); if (index_entry_pos < sti->nb_index_entries) { // Make hole in index_entries and tts_data for new samples -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
