PR #25232 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25232 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25232.patch
>From 12fcbf090e24f3b71ac00e2dc011a9989490ce9f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 18 Oct 2026 05:34:56 +0200 Subject: [PATCH 1/4] avcodec/cbs_jpeg: count byte stuffing only in the entropy-coded part of a scan Fixes: 28PPo4pFl31u Fixes: AISLE-2026-0150-00699 Fixes: assertion failure Assertion failure Replicated through UnModified FFmpeg with an ASAN build Found-by: Joshua Rogers (AISLE) The report suggested counting 0xff bytes only after the scan header. --- libavcodec/cbs_jpeg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cbs_jpeg.c b/libavcodec/cbs_jpeg.c index d64e2baec03..e1631a42469 100644 --- a/libavcodec/cbs_jpeg.c +++ b/libavcodec/cbs_jpeg.c @@ -362,7 +362,7 @@ static int cbs_jpeg_assemble_fragment(CodedBitstreamContext *ctx, unit = &frag->units[i]; size += 2 + unit->data_size; if (unit->type == JPEG_MARKER_SOS) { - for (sp = 0; sp < unit->data_size; sp++) { + for (sp = AV_RB16(unit->data); sp < unit->data_size; sp++) { if (unit->data[sp] == 0xff) ++size; } -- 2.54.0 >From 582d8919ff9582a92aaf8257a2ce470209b895e2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 18 Oct 2026 05:35:34 +0200 Subject: [PATCH 2/4] avcodec/vp9: reset the CBS fragment on every error after reading the packet Fixes: bmXNoLIHNO2l Fixes: AISLE-2026-0150-00467 Fixes: memleak Memleak Replicated through UnModified FFmpeg with ASAN Regression since: c0bf1382a757a4dd45b0c5f8ab70578e7126beca Found-by: Joshua Rogers (AISLE) The report suggested routing these returns through the fail label. --- libavcodec/vp9.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/libavcodec/vp9.c b/libavcodec/vp9.c index c20b1002c11..dfd5da08ed5 100644 --- a/libavcodec/vp9.c +++ b/libavcodec/vp9.c @@ -1702,13 +1702,13 @@ static int vp9_decode_frame(AVCodecContext *avctx, AVFrame *frame, const FFHWAccel *hwaccel = ffhwaccel(avctx->hwaccel); ret = hwaccel->start_frame(avctx, pkt->buf, pkt->data, pkt->size); if (ret < 0) - return ret; + goto fail; ret = hwaccel->decode_slice(avctx, pkt->data, pkt->size); if (ret < 0) - return ret; + goto fail; ret = hwaccel->end_frame(avctx); if (ret < 0) - return ret; + goto fail; for (i = 0; i < 8; i++) { vp9_frame_replace(&s->s.ref_frames[i], @@ -1736,7 +1736,7 @@ static int vp9_decode_frame(AVCodecContext *avctx, AVFrame *frame, if ((ret = update_block_buffers(avctx)) < 0) { av_log(avctx, AV_LOG_ERROR, "Failed to allocate block buffers\n"); - return ret; + goto fail; } if (s->s.h.refreshctx && s->s.h.parallelmode) { int j, k, l, m; @@ -1794,13 +1794,17 @@ static int vp9_decode_frame(AVCodecContext *avctx, AVFrame *frame, data += 4; size -= 4; } - if (tile_size > size) - return AVERROR_INVALIDDATA; + if (tile_size > size) { + ret = AVERROR_INVALIDDATA; + goto fail; + } ret = ff_vpx_init_range_decoder(&s->td[tile_col].c_b[tile_row], data, tile_size); if (ret < 0) - return ret; - if (vpx_rac_get_prob_branchy(&s->td[tile_col].c_b[tile_row], 128)) // marker bit - return AVERROR_INVALIDDATA; + goto fail; + if (vpx_rac_get_prob_branchy(&s->td[tile_col].c_b[tile_row], 128)) { // marker bit + ret = AVERROR_INVALIDDATA; + goto fail; + } data += tile_size; size -= tile_size; } -- 2.54.0 >From 081bf3c4495a8cc87b2062bb0c226112c7e52165 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 18 Oct 2026 05:37:11 +0200 Subject: [PATCH 3/4] avcodec/cbs_vp9: check superframe frame sizes without overflowing size_t Fixes: j1Bk4Efn73Vz Fixes: AISLE-2026-0150-00765 Fixes: out of array read Out of array read Replicated through UnModified FFmpeg with ASAN Found-by: Joshua Rogers (AISLE) The report suggested ordered subtraction checks. --- libavcodec/cbs_vp9.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cbs_vp9.c b/libavcodec/cbs_vp9.c index 37015f5c77d..ffa7d3cc9bb 100644 --- a/libavcodec/cbs_vp9.c +++ b/libavcodec/cbs_vp9.c @@ -397,7 +397,7 @@ static int cbs_vp9_split_fragment(CodedBitstreamContext *ctx, pos = 0; for (i = 0; i <= sfi.frames_in_superframe_minus_1; i++) { - if (pos + sfi.frame_sizes[i] + index_size > frag->data_size) { + if (sfi.frame_sizes[i] > frag->data_size - index_size - pos) { av_log(ctx->log_ctx, AV_LOG_ERROR, "Frame %d too large " "in superframe: %"PRIu32" bytes.\n", i, sfi.frame_sizes[i]); -- 2.54.0 >From 274b558d8190c12c57f7163263996e5f35e8710f Mon Sep 17 00:00:00 2001 From: Joshua Rogers <[email protected]> Date: Sun, 18 Oct 2026 05:37:11 +0200 Subject: [PATCH 4/4] avcodec/cbs_jpeg: check the scan data size without overflowing size_t Fixes: xf78sw1plZNy Fixes: AISLE-2026-0150-00556 Fixes: out of array write Out of array write Replicated through UnModified FFmpeg with ASAN Found-by: Joshua Rogers (AISLE) The check is the one given in the report's recommendation; analysis, testcase and verification by Michael Niedermayer. --- libavcodec/cbs_jpeg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cbs_jpeg.c b/libavcodec/cbs_jpeg.c index e1631a42469..577757dbea1 100644 --- a/libavcodec/cbs_jpeg.c +++ b/libavcodec/cbs_jpeg.c @@ -296,7 +296,7 @@ static int cbs_jpeg_write_scan(CodedBitstreamContext *ctx, return err; if (scan->data) { - if (scan->data_size * 8 > put_bits_left(pbc)) + if (scan->data_size > put_bits_left(pbc) / 8) return AVERROR(ENOSPC); av_assert0(put_bits_count(pbc) % 8 == 0); -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
