PR #24901 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24901 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24901.patch
avcodec/flicvideo: decrement pixel_countdown in the big endian FLI_BRUN byte swap ... Fixes: out of array write Fixes: bQcit4JdHaHN Found-by: Joey Tang <[email protected]> Out of array write Replicated through Modified FFmpeg with ASAN Segmentation fault Replicated through UnModified FFmpeg (s390x) with qemu-s390x From 7c1a9287615439a457543e184f50b09102e36151 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 06:18:55 +0200 Subject: [PATCH 1/2] avcodec/flicvideo: decrement pixel_countdown in the big endian FLI_BRUN byte swap Fixes: out of array write Fixes: bQcit4JdHaHN Found-by: Joey Tang <[email protected]> Out of array write Replicated through Modified FFmpeg with ASAN Segmentation fault Replicated through UnModified FFmpeg (s390x) with qemu-s390x --- libavcodec/flicvideo.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c index f17e61a9f2..c678a4832f 100644 --- a/libavcodec/flicvideo.c +++ b/libavcodec/flicvideo.c @@ -883,6 +883,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx, while (pixel_countdown > 0) { *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[pixel_ptr]); pixel_ptr += 2; + pixel_countdown--; } #endif y_ptr += s->frame->linesize[0]; -- 2.52.0 From 4bbb9dd88ff9db7bebbde757d70116d7b71d8a55 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 06:18:55 +0200 Subject: [PATCH 2/2] avcodec/flicvideo: byte swap the decoded pixels in big endian FLI_BRUN The swap read the packet at frame offsets instead of the decoded line, past the end of the packet for frames larger than it. That this reads past the packet was found during triage of the security report bQcit4JdHaHN. Fixes: out of array read Fixes: bQcit4JdHaHN Found-by: Joey Tang <[email protected]> Out of array read Replicated through Modified FFmpeg with ASAN Segmentation fault Replicated through UnModified FFmpeg (s390x) with qemu-s390x --- libavcodec/flicvideo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c index c678a4832f..b8157c0e51 100644 --- a/libavcodec/flicvideo.c +++ b/libavcodec/flicvideo.c @@ -881,7 +881,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx, pixel_ptr = y_ptr; pixel_countdown = s->avctx->width; while (pixel_countdown > 0) { - *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[pixel_ptr]); + *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&pixels[pixel_ptr]); pixel_ptr += 2; pixel_countdown--; } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
