PR #25704 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704.patch
>From 839c93f261cd3e1719edfac4244a2d0055ce8841 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 01:22:43 +0100 Subject: [PATCH 1/8] avcodec/jvdec: check init_get_bits8() for failure Fixes: gBKyT14GTvie Fixes: AISLE-2026-0150-00317 Fixes: null pointer dereference Null pointer dereference Replicated through API with ASAN (one 268435460 byte packet sent to the jv decoder; the JV demuxer limits video_size to 24 bits) Found-by: Joshua Rogers (AISLE) --- libavcodec/jvdec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/jvdec.c b/libavcodec/jvdec.c index d8c78cd18f6..f2d7a15f0d9 100644 --- a/libavcodec/jvdec.c +++ b/libavcodec/jvdec.c @@ -166,7 +166,8 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe, if (video_type == 0 || video_type == 1) { GetBitContext gb; - init_get_bits(&gb, buf, 8 * video_size); + if ((ret = init_get_bits8(&gb, buf, video_size)) < 0) + return ret; if ((ret = ff_reget_buffer(avctx, s->frame, 0)) < 0) return ret; -- 2.54.0 >From 5d7b743bdfb724df21fd43a3d7f3258382eb578c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 01:22:43 +0100 Subject: [PATCH 2/8] avcodec/eatqi: check init_get_bits8() for failure Fixes: 8DIglq00jxSy Fixes: AISLE-2026-0150-00271 Fixes: null pointer dereference Null pointer dereference Replicated through UnModified FFmpeg with ASAN (EA file with a pIQT chunk carrying a 2^28 byte payload) Found-by: Joshua Rogers (AISLE) --- libavcodec/eatqi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/eatqi.c b/libavcodec/eatqi.c index 421ed510094..3249ef3e0e6 100644 --- a/libavcodec/eatqi.c +++ b/libavcodec/eatqi.c @@ -151,7 +151,9 @@ static int tqi_decode_frame(AVCodecContext *avctx, AVFrame *frame, return AVERROR(ENOMEM); t->bsdsp.bswap_buf(t->bitstream_buf, (const uint32_t *) buf, (buf_end - buf) / 4); - init_get_bits(&t->gb, t->bitstream_buf, 8 * (buf_end - buf)); + ret = init_get_bits8(&t->gb, t->bitstream_buf, buf_end - buf); + if (ret < 0) + return ret; t->last_dc[0] = t->last_dc[1] = -- 2.54.0 >From 26b4c37526fe0ecf1095b45daac08050f25f7659 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 01:22:43 +0100 Subject: [PATCH 3/8] avcodec/motionpixels: check init_get_bits8() for failure Fixes: RW8zVRAMA9UY Fixes: AISLE-2026-0150-00225 Fixes: null pointer dereference Null pointer dereference Replicated through API with ASAN (one 2^28 byte packet sent to the motionpixels decoder; the MVI demuxer limits packets to 2^24 bytes) Found-by: Joshua Rogers (AISLE) --- libavcodec/motionpixels.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/motionpixels.c b/libavcodec/motionpixels.c index e5c3daece6a..04a3528ca06 100644 --- a/libavcodec/motionpixels.c +++ b/libavcodec/motionpixels.c @@ -299,7 +299,8 @@ static int mp_decode_frame(AVCodecContext *avctx, AVFrame *rframe, buf_size / 4); if (buf_size & 3) memcpy(mp->bswapbuf + (buf_size & ~3), buf + (buf_size & ~3), buf_size & 3); - init_get_bits(&gb, mp->bswapbuf, buf_size * 8); + if ((ret = init_get_bits8(&gb, mp->bswapbuf, buf_size)) < 0) + return ret; memset(mp->changes_map, 0, avctx->width * avctx->height); for (i = !(avctx->extradata[1] & 2); i < 2; ++i) { -- 2.54.0 >From 5195d6f9729ad00b93e4d0f0bea309416fb4713e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 01:22:43 +0100 Subject: [PATCH 4/8] avcodec/bink: check init_get_bits8() for failure Fixes: 5uCy7fcyAjx7 Fixes: AISLE-2026-0150-00206 Fixes: null pointer dereference Null pointer dereference Replicated through UnModified FFmpeg with ASAN (BIKb file with one 2^28 + 16 byte frame) Found-by: Joshua Rogers (AISLE) --- libavcodec/bink.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/bink.c b/libavcodec/bink.c index e10c8e09668..90257453773 100644 --- a/libavcodec/bink.c +++ b/libavcodec/bink.c @@ -1260,7 +1260,6 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame, BinkContext * const c = avctx->priv_data; GetBitContext gb; int plane, plane_idx, ret; - int bits_count = pkt->size << 3; if (c->version > 'b') { if ((ret = ff_get_buffer(avctx, frame, AV_GET_BUFFER_FLAG_REF)) < 0) @@ -1272,7 +1271,8 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame, return ret; } - init_get_bits(&gb, pkt->data, bits_count); + if ((ret = init_get_bits8(&gb, pkt->data, pkt->size)) < 0) + return ret; if (c->has_alpha) { if (c->version >= 'i') skip_bits_long(&gb, 32); @@ -1295,7 +1295,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame, c->frame_num == 1, !!plane)) < 0) return ret; } - if (get_bits_count(&gb) >= bits_count) + if (get_bits_left(&gb) <= 0) break; } -- 2.54.0 >From 1206df65e54b6e9c01459c7cd9a95f9bde2736d7 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 01:22:44 +0100 Subject: [PATCH 5/8] avcodec/vble: check init_get_bits8() for failure Fixes: 218yj1AmW5fg Fixes: AISLE-2026-0150-00071 Fixes: null pointer dereference Null pointer dereference Replicated through UnModified FFmpeg with ASAN (AVI file with one 268435452 byte VBLE frame) Found-by: Joshua Rogers (AISLE) --- libavcodec/vble.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/vble.c b/libavcodec/vble.c index c48feb9a591..e8173badfa1 100644 --- a/libavcodec/vble.c +++ b/libavcodec/vble.c @@ -136,7 +136,8 @@ static int vble_decode_frame(AVCodecContext *avctx, AVFrame *pic, if (version != 1) av_log(avctx, AV_LOG_WARNING, "Unsupported VBLE Version: %d\n", version); - init_get_bits(&gb, src + 4, (avpkt->size - 4) * 8); + if ((ret = init_get_bits8(&gb, src + 4, avpkt->size - 4)) < 0) + return ret; /* Unpack */ if (vble_unpack(ctx, &gb) < 0) { -- 2.54.0 >From d40c1b12811814fc6c2d0816527b003d8510ea06 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 01:22:44 +0100 Subject: [PATCH 6/8] avcodec/cljrdec: check init_get_bits8() for failure Fixes: CC4WYLNBQ75g Fixes: AISLE-2026-0150-00062 Fixes: null pointer dereference Null pointer dereference Replicated through UnModified FFmpeg with ASAN (AVI file with one 2^28 byte CLJR frame) Found-by: Joshua Rogers (AISLE) --- libavcodec/cljrdec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/cljrdec.c b/libavcodec/cljrdec.c index 79fbea990f3..ffd9f27e1ac 100644 --- a/libavcodec/cljrdec.c +++ b/libavcodec/cljrdec.c @@ -51,7 +51,8 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *p, if ((ret = ff_get_buffer(avctx, p, 0)) < 0) return ret; - init_get_bits(&gb, buf, buf_size * 8); + if ((ret = init_get_bits8(&gb, buf, buf_size)) < 0) + return ret; for (y = 0; y < avctx->height; y++) { uint8_t *luma = &p->data[0][y * p->linesize[0]]; -- 2.54.0 >From 9691e4fde64e14de73c298562c4e475f9412b5ad Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 01:22:44 +0100 Subject: [PATCH 7/8] avcodec/eatgv: check init_get_bits8() for failure Fixes: q0AsSZJdP8Nm Fixes: AISLE-2026-0150-00052 Fixes: null pointer dereference Null pointer dereference Replicated through UnModified FFmpeg with ASAN (EA file with a kVGT frame followed by an fVGT frame whose compressed block section is 2^28 bytes) Found-by: Joshua Rogers (AISLE) --- libavcodec/eatgv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/eatgv.c b/libavcodec/eatgv.c index 35bd88b7403..d71a0c6f93f 100644 --- a/libavcodec/eatgv.c +++ b/libavcodec/eatgv.c @@ -209,7 +209,9 @@ static int tgv_decode_inter(TgvContext *s, AVFrame *frame, buf += num_blocks_raw * 16; /* read compressed blocks */ - init_get_bits(&gb, buf, (buf_end - buf) << 3); + int ret = init_get_bits8(&gb, buf, buf_end - buf); + if (ret < 0) + return ret; for (i = 0; i < num_blocks_packed; i++) { int tmp[4]; for (j = 0; j < 4; j++) -- 2.54.0 >From ec887b13a88afbaf44fb28c3045bda5d434da8dc Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 3 Nov 2026 01:22:44 +0100 Subject: [PATCH 8/8] avcodec/g726: check init_get_bits8() for failure Fixes: pvCZj7vpETa5 Fixes: AISLE-2026-0150-00809 Fixes: null pointer dereference Null pointer dereference Replicated through UnModified FFmpeg with ASAN (AVI file with one 268435392 byte G.726 audio chunk) Found-by: Joshua Rogers (AISLE) --- libavcodec/g726.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavcodec/g726.c b/libavcodec/g726.c index d793dec281a..699b6742321 100644 --- a/libavcodec/g726.c +++ b/libavcodec/g726.c @@ -462,6 +462,9 @@ static int g726_decode_frame(AVCodecContext *avctx, AVFrame *frame, GetBitContext gb; int out_samples, ret; + if ((ret = init_get_bits8(&gb, buf, buf_size)) < 0) + return ret; + out_samples = buf_size * 8 / c->code_size; /* get output buffer */ @@ -470,8 +473,6 @@ static int g726_decode_frame(AVCodecContext *avctx, AVFrame *frame, return ret; samples = (int16_t *)frame->data[0]; - init_get_bits(&gb, buf, buf_size * 8); - while (out_samples--) *samples++ = g726_decode(c, c->little_endian ? get_bits_le(&gb, c->code_size) : -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
