PR #25077 opened by romainhedouin URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25077 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25077.patch
The skip check computed `frame - frame_end` which is never positive so every DDS1 skip opcode with a non-zero length was rejected as invalid data It ought to check the remaining space instead Tested: make fate passes, none of the FATE DFA samples contain a DDS1 chunk A crafted 16x16 DFA with a DDS1 skip failed with "Error decoding DDS1 chunk" before and decodes correctly now, a skip past the end of the frame is still rejected, I can add this test to this PR if maintainer prefer Signed-off-by: romainhedouin <[email protected]> <!-- If this PR requires new FATE test samples, attach them to the PR and list their target paths below (relative to the fate-suite root). Attached filenames must match the sample's filename: ```fate-samples # e.g. vorbis/new-sample.ogg ``` --> >From e6ea2520359c20357f153efb8f5fcb774819a9d7 Mon Sep 17 00:00:00 2001 From: romainhedouin <[email protected]> Date: Wed, 14 Oct 2026 21:07:20 +0200 Subject: [PATCH] avcodec/dfa: fix inverted bounds check in decode_dds1() The skip check computed frame - frame_end, which is never positive, so every DDS1 skip opcode with a non-zero length was rejected as invalid data. Check the remaining space instead. Tested: make fate passes; none of the FATE DFA samples contain a DDS1 chunk. A crafted 16x16 DFA with a DDS1 skip failed with "Error decoding DDS1 chunk" before and decodes correctly now; a skip past the end of the frame is still rejected. Found with the help of an AI code review; verified by hand. Signed-off-by: romainhedouin <[email protected]> --- libavcodec/dfa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/dfa.c b/libavcodec/dfa.c index 1efaefcb69..c099f22bdf 100644 --- a/libavcodec/dfa.c +++ b/libavcodec/dfa.c @@ -175,7 +175,7 @@ static int decode_dds1(GetByteContext *gb, uint8_t *frame, int width, int height } } else if (bitbuf & (mask << 1)) { v = bytestream2_get_le16(gb)*2; - if (frame - frame_end < v) + if (frame_end - frame < v) return AVERROR_INVALIDDATA; frame += v; } else { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
