PR #24882 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24882 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24882.patch
no memory safety issue is known to depend on it. Found-by: OpenAI Security Research Reported in the security report srZp1wXh4CXQ >From 18bc22300030b27d18d405385d39a6482090c334 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 4 Oct 2026 23:42:28 +0200 Subject: [PATCH 1/3] avformat/mov: bound ipco and ipma by the iprp size This is hardening, no memory safety issue is known to depend on it. Found-by: OpenAI Security Research Reported in the security report srZp1wXh4CXQ Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 71c4e38c88..128e096b17 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -9917,9 +9917,10 @@ static int mov_read_iprp(MOVContext *c, AVIOContext *pb, MOVAtom atom) a.size = avio_rb32(pb); a.type = avio_rl32(pb); - if (a.size < 8 || a.type != MKTAG('i','p','c','o')) + if (a.size < 8 || a.size > atom.size || a.type != MKTAG('i','p','c','o')) return AVERROR_INVALIDDATA; + atom.size -= a.size; a.size -= 8; while (a.size >= 8) { MOVAtoms *ref = av_dynarray2_add((void**)&atoms, &nb_atoms, sizeof(MOVAtoms), NULL); @@ -9955,7 +9956,7 @@ static int mov_read_iprp(MOVContext *c, AVIOContext *pb, MOVAtom atom) a.size = avio_rb32(pb); a.type = avio_rl32(pb); - if (a.size < 8 || a.type != MKTAG('i','p','m','a')) { + if (a.size < 16 || a.size > atom.size || a.type != MKTAG('i','p','m','a')) { ret = AVERROR_INVALIDDATA; goto fail; } @@ -9963,12 +9964,14 @@ static int mov_read_iprp(MOVContext *c, AVIOContext *pb, MOVAtom atom) version = avio_r8(pb); flags = avio_rb24(pb); count = avio_rb32(pb); + a.size -= 16; for (int i = 0; i < count; i++) { int item_id = version ? avio_rb32(pb) : avio_rb16(pb); int assoc_count = avio_r8(pb); - if (avio_feof(pb)) { + a.size -= (version ? 5 : 3) + assoc_count * (1 + (flags & 1)); + if (avio_feof(pb) || a.size < 0) { ret = AVERROR_INVALIDDATA; goto fail; } -- 2.52.0 >From 7d0eedf04b6eb5c2d1e527a8f4b6f059eb75c931 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 4 Oct 2026 23:43:40 +0200 Subject: [PATCH 2/3] avformat/mov: do not seek back to cache ipco properties This could use ffio_ensure_seekback() but simply storing the 2 values is simpler no memory safety issue is known to depend on it. Found-by: OpenAI Security Research Reported in the security report srZp1wXh4CXQ Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 128e096b17..336aab307b 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -9939,8 +9939,9 @@ static int mov_read_iprp(MOVContext *c, AVIOContext *pb, MOVAtom atom) goto fail; } av_log(c->fc, AV_LOG_TRACE, "ipco: index %d, box type %s\n", nb_atoms, av_fourcc2str(ref->type)); - avio_seek(pb, -8, SEEK_CUR); - if (avio_read(pb, ref->data, ref->size) != ref->size) { + AV_WB32(ref->data, ref->size); + AV_WL32(ref->data + 4, ref->type); + if (avio_read(pb, ref->data + 8, ref->size - 8) != ref->size - 8) { ret = AVERROR_INVALIDDATA; goto fail; } -- 2.52.0 >From dbe4744d4cebd77377a1c6fb43ae3c9b1248dfd5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 4 Oct 2026 23:44:39 +0200 Subject: [PATCH 3/3] avformat/mov: accept ipma associations with property_index 0 ISO/IEC 23008-12 defines a property_index of 0 as no property being associated, but mov_read_iprp() rejected it, and with it the whole file. Found during triage of the security report srZp1wXh4CXQ Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 336aab307b..811a752862 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -9984,7 +9984,9 @@ static int mov_read_iprp(MOVContext *c, AVIOContext *pb, MOVAtom atom) index <<= 8; index |= avio_r8(pb); } - if (index > nb_atoms || index <= 0) { + if (!index) + continue; + if (index > nb_atoms) { ret = AVERROR_INVALIDDATA; goto fail; } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
