PR #25074 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25074 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25074.patch
>From 8de75a9facd959c1ab36ca347577c0f0254eed25 Mon Sep 17 00:00:00 2001 From: zhang xingxing <[email protected]> Date: Tue, 13 Oct 2026 06:52:48 +0200 Subject: [PATCH 1/7] avcodec/mpc7: reject a last frame length larger than a frame Fixes: out of array read Fixes: dcrkQkffMQ8b Fixes: swarm-Missing-bounds-check-on-last-frame-length-enables-heap-OOB-read-e00668 Found-by: zhang xingxing <[email protected]> Out of array read Replicated through UnModified FFmpeg with ASAN Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/mpc7.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/mpc7.c b/libavcodec/mpc7.c index b95cec1f0f..1824c7e98b 100644 --- a/libavcodec/mpc7.c +++ b/libavcodec/mpc7.c @@ -109,6 +109,10 @@ static av_cold int mpc7_decode_init(AVCodecContext * avctx) skip_bits_long(&gb, 88); c->gapless = get_bits1(&gb); c->lastframelen = get_bits(&gb, 11); + if (c->lastframelen > MPC_FRAME_SIZE) { + av_log(avctx, AV_LOG_ERROR, "Invalid last frame length: %d\n", c->lastframelen); + return AVERROR_INVALIDDATA; + } av_log(avctx, AV_LOG_DEBUG, "IS: %d, MSS: %d, TG: %d, LFL: %d, bands: %d\n", c->IS, c->MSS, c->gapless, c->lastframelen, c->maxbands); c->frames_to_skip = 0; -- 2.52.0 >From 5bba64114aaa3a37e7a5c9d22b70804e9dfee8c8 Mon Sep 17 00:00:00 2001 From: zhang xingxing <[email protected]> Date: Tue, 13 Oct 2026 06:54:15 +0200 Subject: [PATCH 2/7] avcodec/dvbsubdec: check the object segment size before reading its header This is not a security issue. Fixes: hlm9X3ZdVjBu Fixes: swarm-Missing-buf_size-validation-in-dvbsub_parse_object_segment-a29b35 Found-by: zhang xingxing <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/dvbsubdec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/dvbsubdec.c b/libavcodec/dvbsubdec.c index 7608a44423..0256e8355d 100644 --- a/libavcodec/dvbsubdec.c +++ b/libavcodec/dvbsubdec.c @@ -999,6 +999,9 @@ static int dvbsub_parse_object_segment(AVCodecContext *avctx, int coding_method, non_modifying_color; + if (buf_size < 3) + return AVERROR_INVALIDDATA; + object_id = AV_RB16(buf); buf += 2; @@ -1011,6 +1014,8 @@ static int dvbsub_parse_object_segment(AVCodecContext *avctx, non_modifying_color = ((*buf++) >> 1) & 1; if (coding_method == 0) { + if (buf_end - buf < 4) + return AVERROR_INVALIDDATA; top_field_len = AV_RB16(buf); buf += 2; bottom_field_len = AV_RB16(buf); -- 2.52.0 >From 82592b0387ae791818811b69eb495c9866647461 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 13 Oct 2026 06:56:14 +0200 Subject: [PATCH 3/7] avformat/md5proto: free the MD5 context when opening the output fails This is not a security issue. Fixes: ORPoDnVi3BLg Fixes: swarm-MD5-context-leaked-when-output-URL-open-fails-e4415f Found-by: zhang xingxing <[email protected]> Memory leak Replicated through UnModified FFmpeg with LSAN Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/md5proto.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libavformat/md5proto.c b/libavformat/md5proto.c index 653bf10e66..4cf5c3d386 100644 --- a/libavformat/md5proto.c +++ b/libavformat/md5proto.c @@ -62,6 +62,7 @@ static int md5_close(URLContext *h) int err = 0; av_md5_final(c->md5, md5); + av_freep(&c->md5); ff_data_to_hex(buf, md5, sizeof(md5), 1); buf[2 * sizeof(md5)] = '\n'; @@ -80,8 +81,6 @@ static int md5_close(URLContext *h) err = AVERROR(errno); } - av_freep(&c->md5); - return err; } -- 2.52.0 >From 7aaad8e58d5e409aa5403de9ac4a134a143dc525 Mon Sep 17 00:00:00 2001 From: zhang xingxing <[email protected]> Date: Tue, 13 Oct 2026 06:57:02 +0200 Subject: [PATCH 4/7] avformat/tls_mbedtls: free the mbedtls contexts on every error path This is not a security issue. Not replicated, compile tested only (mbedtls 3.6.2). Fixes: T7EtPuJBKWqg Fixes: swarm-Memory-leak-early-return-skips-mbedtls-resource-cleanup-a1d295 Found-by: zhang xingxing <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/tls_mbedtls.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/tls_mbedtls.c b/libavformat/tls_mbedtls.c index 444148be8a..211652d38a 100644 --- a/libavformat/tls_mbedtls.c +++ b/libavformat/tls_mbedtls.c @@ -186,7 +186,7 @@ static int mbedtls_gen_x509_cert(mbedtls_pk_context *key, char *cert_buf, size_t ret = av_random_bytes((uint8_t *)serial, sizeof(serial)); if (ret < 0) { av_log(NULL, AV_LOG_ERROR, "Failed to generate random serial number!\n"); - return ret; + goto end; } if ((ret = mbedtls_x509write_crt_set_serial_raw(&crt, serial, sizeof(serial))) != 0) { @@ -208,7 +208,7 @@ static int mbedtls_gen_x509_cert(mbedtls_pk_context *key, char *cert_buf, size_t if ((ret = mbedtls_x509write_crt_pem(&crt, cert_buf, cert_sz, mbedtls_ctr_drbg_random, &ctr_drbg)) != 0) { av_log(NULL, AV_LOG_ERROR, "mbedtls_x509write_crt_pem returned %d\n", ret); - return ret; + goto end; } end: -- 2.52.0 >From d2667298be0673d6b32900ae6249fb6fcc6e987b Mon Sep 17 00:00:00 2001 From: zhang xingxing <[email protected]> Date: Tue, 13 Oct 2026 06:58:35 +0200 Subject: [PATCH 5/7] avfilter/qrencode: free the rendered width expressions This is not a security issue. Fixes: oFKoC1YimRPu Fixes: swarm-Memory-leak-qr--text-and-pexpr-fields-not-freed-in-uninit-5cc723 Found-by: zhang xingxing <[email protected]> Memory leak Replicated through UnModified FFmpeg with LSAN Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/qrencode.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavfilter/qrencode.c b/libavfilter/qrencode.c index 29fa5d3785..98344fa43e 100644 --- a/libavfilter/qrencode.c +++ b/libavfilter/qrencode.c @@ -334,6 +334,8 @@ static av_cold void uninit(AVFilterContext *ctx) av_expr_free(qr->x_pexpr); av_expr_free(qr->y_pexpr); + av_expr_free(qr->rendered_qrcode_width_pexpr); + av_expr_free(qr->rendered_padded_qrcode_width_pexpr); av_bprint_finalize(&qr->expanded_text, NULL); -- 2.52.0 >From b96fae92444c50102251268cfce059f5ecd382a2 Mon Sep 17 00:00:00 2001 From: zhang xingxing <[email protected]> Date: Tue, 13 Oct 2026 06:59:47 +0200 Subject: [PATCH 6/7] avcodec/cbs_apv: reject user defined metadata shorter than its UUID This is not a security issue. Fixes: 00smV7L5DOfY Fixes: swarm-metadata_user_defined-data_size-underflows-on-payload_size-16-5ff8a8 Found-by: zhang xingxing <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/cbs_apv_syntax_template.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/cbs_apv_syntax_template.c b/libavcodec/cbs_apv_syntax_template.c index 8640bcfa00..3cdb320ca4 100644 --- a/libavcodec/cbs_apv_syntax_template.c +++ b/libavcodec/cbs_apv_syntax_template.c @@ -441,6 +441,9 @@ static int FUNC(metadata_user_defined)(CodedBitstreamContext *ctx, HEADER("User-Defined Metadata"); + if (payload_size < 16) + return AVERROR_INVALIDDATA; + for (int i = 0; i < 16; i++) ubs(8, uuid[i], 1, i); -- 2.52.0 >From 392c488c4d3828bc3c297e96e6b498e88b53743e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 13 Oct 2026 07:00:12 +0200 Subject: [PATCH 7/7] avcodec/cbs_apv: reject ITU-T T.35 metadata shorter than its country code Fixes: F9Vetk0Ebf1N Found during triage of the security report 00smV7L5DOfY Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/cbs_apv_syntax_template.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/cbs_apv_syntax_template.c b/libavcodec/cbs_apv_syntax_template.c index 3cdb320ca4..bcc72a015d 100644 --- a/libavcodec/cbs_apv_syntax_template.c +++ b/libavcodec/cbs_apv_syntax_template.c @@ -353,6 +353,9 @@ static int FUNC(metadata_itu_t_t35)(CodedBitstreamContext *ctx, ub(8, itu_t_t35_country_code); + if (payload_size < 1 + (current->itu_t_t35_country_code == 0xff)) + return AVERROR_INVALIDDATA; + if (current->itu_t_t35_country_code == 0xff) { ub(8, itu_t_t35_country_code_extension); --read_size; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
