PR #25800 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25800 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25800.patch
>From 7f250c7cc57ab17475ff26a4b73c7ef0a82f09e4 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 6 Nov 2026 03:52:54 +0100 Subject: [PATCH 1/6] avfilter/vf_w3fdif: reject chroma planes of less than 2 lines Fixes: heap-buffer-overflow Fixes: QVQGy0DTFsYd Found-by: SecBuddyF, Tencent KeenLab (CodeBuddy Security) Heap out of array read Replicated through UnModified FFmpeg with ASAN --- libavfilter/vf_w3fdif.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavfilter/vf_w3fdif.c b/libavfilter/vf_w3fdif.c index 465453db253..73a8168284d 100644 --- a/libavfilter/vf_w3fdif.c +++ b/libavfilter/vf_w3fdif.c @@ -288,6 +288,11 @@ static int config_input(AVFilterLink *inlink) return AVERROR(EINVAL); } + if (s->planeheight[1] < 2) { + av_log(ctx, AV_LOG_ERROR, "Video with chroma planes of less than 2 lines is not supported\n"); + return AVERROR(EINVAL); + } + s->nb_planes = av_pix_fmt_count_planes(inlink->format); nb_threads = ff_filter_get_nb_threads(ctx); s->work_line = av_calloc(nb_threads, sizeof(*s->work_line)); -- 2.54.0 >From 2aeb28fe520d0c76776329001f3f49b17bef3ab3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 6 Nov 2026 03:52:54 +0100 Subject: [PATCH 2/6] avfilter/af_anlmdn: do not write past the end of a short last frame Fixes: heap-buffer-overflow Fixes: uQUc1sfqWcj8 Found-by: Secbuddy, Tencent Keen Security Lab (tested by kvartet) Heap out of array write Replicated through UnModified FFmpeg with ASAN --- libavfilter/af_anlmdn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavfilter/af_anlmdn.c b/libavfilter/af_anlmdn.c index ce91eb1cfd8..366e63cb09d 100644 --- a/libavfilter/af_anlmdn.c +++ b/libavfilter/af_anlmdn.c @@ -219,7 +219,7 @@ static int filter_channel(AVFilterContext *ctx, void *arg, int ch, int nb_jobs) memcpy(&src[offset], in->extended_data[ch], in->nb_samples * sizeof(float)); memset(&src[offset + in->nb_samples], 0, (H - in->nb_samples) * sizeof(float)); - for (int i = S; i < H + S; i++) { + for (int i = S; i < in->nb_samples + S; i++) { float P = 0.f, Q = 0.f; int v = 0; -- 2.54.0 >From e32ce62fe8354bd633bd26f54ffbf1ddc2664fd7 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 6 Nov 2026 03:52:55 +0100 Subject: [PATCH 3/6] avfilter/vf_selectivecolor: check the correction method read from the psfile Fixes: out of array read Fixes: urb6qL5xnaVD Fixes: swarm-Unvalidated-correction_method-from-psfile-causes-OOB-function-pointer-read-f780a0 Found-by: zhang xingxing <[email protected]> The same check was suggested in the report. Out of array read Replicated through UnModified FFmpeg with ASAN and UBSAN --- libavfilter/vf_selectivecolor.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavfilter/vf_selectivecolor.c b/libavfilter/vf_selectivecolor.c index 4fa8b32f3ca..6d27bdacb07 100644 --- a/libavfilter/vf_selectivecolor.c +++ b/libavfilter/vf_selectivecolor.c @@ -210,6 +210,10 @@ static int parse_psfile(AVFilterContext *ctx, const char *fname) "the settings might not be loaded properly\n", version); READ16(s->correction_method); + if (s->correction_method >= NB_CORRECTION_METHODS) { + ret = AVERROR_INVALIDDATA; + goto end; + } // 1st CMYK entry is reserved/unused for (i = 0; i < FF_ARRAY_ELEMS(s->cmyk_adjust[0]); i++) { -- 2.54.0 >From a73ebd49020c5153bd5922704113a8a14dc1d178 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 6 Nov 2026 03:52:56 +0100 Subject: [PATCH 4/6] avformat/nsvdec: fail on aux chunks larger than the video size Fixes: N4g8ebEjqVoK Fixes: swarm-Unsigned-vsize-underflow-in-NSV-aux-chunk-parsing-07da0a Found-by: zhang xingxing <[email protected]> Wrong error code Replicated through UnModified FFmpeg --- libavformat/nsvdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c index b18fc46a4e7..1ea5364f475 100644 --- a/libavformat/nsvdec.c +++ b/libavformat/nsvdec.c @@ -587,6 +587,8 @@ null_chunk_retry: auxsize = avio_rl16(pb); auxtag = avio_rl32(pb); avio_skip(pb, auxsize); + if (vsize < auxsize + sizeof(uint16_t) + sizeof(uint32_t)) + return AVERROR_INVALIDDATA; vsize -= auxsize + sizeof(uint16_t) + sizeof(uint32_t); /* that's becoming brain-dead */ } -- 2.54.0 >From 11502f20c55b6598b27a9f86f6be938f5796360e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 6 Nov 2026 03:59:29 +0100 Subject: [PATCH 5/6] avfilter/vf_selectivecolor: unmap the psfile with the mapped pointer and size Fixes: xFNgu3kY8YOa Found during review of the fix for the security report urb6qL5xnaVD The same fix for vf_curves is in PR #25298 by Martin Mirchev. Leaked file mapping Replicated through UnModified FFmpeg with strace --- libavfilter/vf_selectivecolor.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/libavfilter/vf_selectivecolor.c b/libavfilter/vf_selectivecolor.c index 6d27bdacb07..2da97dfd4bb 100644 --- a/libavfilter/vf_selectivecolor.c +++ b/libavfilter/vf_selectivecolor.c @@ -186,13 +186,15 @@ static int parse_psfile(AVFilterContext *ctx, const char *fname) { int16_t val; int ret, i, version; - uint8_t *buf; - size_t size; + uint8_t *map, *buf; + size_t map_size, size; SelectiveColorContext *s = ctx->priv; - ret = av_file_map(fname, &buf, &size, 0, NULL); + ret = av_file_map(fname, &map, &map_size, 0, NULL); if (ret < 0) return ret; + buf = map; + size = map_size; #define READ16(dst) do { \ if (size < 2) { \ @@ -235,7 +237,7 @@ static int parse_psfile(AVFilterContext *ctx, const char *fname) } end: - av_file_unmap(buf, size); + av_file_unmap(map, map_size); return ret; } -- 2.54.0 >From 37513b673ab7b35ce1f670e2b4c64473a31cf928 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 6 Nov 2026 04:20:15 +0100 Subject: [PATCH 6/6] tests/fate/demux: overwrite the segment when generating the hls-webvtt-discont data The data is regenerated whenever ffmpeg is rebuilt, but without -y ffmpeg refuses to overwrite the hls-webvtt-discont-a0.ts of an earlier run, and FATE fails. Fixes: make fate after rebuilding ffmpeg --- tests/fate/demux.mak | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/fate/demux.mak b/tests/fate/demux.mak index 8a624152550..58db704a0b3 100644 --- a/tests/fate/demux.mak +++ b/tests/fate/demux.mak @@ -237,7 +237,7 @@ tests/data/hls-webvtt-discont.m3u8: TAG = GEN tests/data/hls-webvtt-discont.m3u8: ffmpeg$(PROGSSUF)$(EXESUF) | tests/data $(M)$(TARGET_EXEC) $(TARGET_PATH)/$< -nostdin \ -f lavfi -i "aevalsrc=0:d=2" -c:a mp2fixed -flags +bitexact -muxdelay 0 -muxpreload 0 -output_ts_offset 10 \ - -f mpegts $(TARGET_PATH)/tests/data/hls-webvtt-discont-a0.ts 2>/dev/null + -f mpegts -y $(TARGET_PATH)/tests/data/hls-webvtt-discont-a0.ts 2>/dev/null $(Q)cp tests/data/hls-webvtt-discont-a0.ts tests/data/hls-webvtt-discont-a1.ts $(Q)printf '#EXTM3U\n#EXT-X-TARGETDURATION:2\n#EXTINF:2,\nhls-webvtt-discont-a0.ts\n#EXT-X-DISCONTINUITY\n#EXTINF:2,\nhls-webvtt-discont-a1.ts\n#EXT-X-ENDLIST\n' > tests/data/hls-webvtt-discont-a.m3u8 $(Q)printf 'WEBVTT\nX-TIMESTAMP-MAP=MPEGTS:900000,LOCAL:00:00:00.000\n\n00:00.500 --> 00:01.500\nhello\n' > tests/data/hls-webvtt-discont-s0.vtt -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
