Attached.
From d0b6b08b38e5f4314f046118bff70d1e08b46bbf Mon Sep 17 00:00:00 2001
From: Paul B Mahol <one...@gmail.com>
Date: Tue, 26 Sep 2023 09:37:12 +0200
Subject: [PATCH] avcodec/vlc: fix heap use after free
Signed-off-by: Paul B Mahol <one...@gmail.com>
---
libavcodec/vlc.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/libavcodec/vlc.c b/libavcodec/vlc.c
index 3b66c94354..2b7535c2ce 100644
--- a/libavcodec/vlc.c
+++ b/libavcodec/vlc.c
@@ -237,8 +237,6 @@ static int vlc_common_end(VLC *vlc, int nb_bits, int nb_codes, VLCcode *codes,
av_log(NULL, AV_LOG_ERROR, "needed %d had %d\n", vlc->table_size, vlc->table_allocated);
av_assert0(ret >= 0);
} else {
- if (codes != localbuf)
- av_free(codes);
if (ret < 0) {
av_freep(&vlc->table);
return ret;
@@ -299,8 +297,11 @@ int ff_vlc_init_sparse(VLC *vlc, int nb_bits, int nb_codes,
COPY(len && len <= nb_bits);
nb_codes = j;
- return vlc_common_end(vlc, nb_bits, nb_codes, buf,
+ ret = vlc_common_end(vlc, nb_bits, nb_codes, buf,
flags, localbuf);
+ if (buf != localbuf)
+ av_free(buf);
+ return ret;
}
int ff_vlc_init_from_lengths(VLC *vlc, int nb_bits, int nb_codes,
@@ -335,19 +336,21 @@ int ff_vlc_init_from_lengths(VLC *vlc, int nb_bits, int nb_codes,
continue;
if (len > len_max || code & ((1U << (32 - len)) - 1)) {
av_log(logctx, AV_LOG_ERROR, "Invalid VLC (length %u)\n", len);
+ ret = AVERROR_INVALIDDATA;
goto fail;
}
code += 1U << (32 - len);
if (code > UINT32_MAX + 1ULL) {
av_log(logctx, AV_LOG_ERROR, "Overdetermined VLC tree\n");
+ ret = AVERROR_INVALIDDATA;
goto fail;
}
}
- return vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf);
+ ret = vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf);
fail:
if (buf != localbuf)
av_free(buf);
- return AVERROR_INVALIDDATA;
+ return ret;
}
static void add_level(VLC_MULTI_ELEM *table, const int nb_elems,
@@ -463,22 +466,24 @@ int ff_vlc_init_multi_from_lengths(VLC *vlc, VLC_MULTI *multi, int nb_bits, int
continue;
if (len > len_max || code & ((1U << (32 - len)) - 1)) {
av_log(logctx, AV_LOG_ERROR, "Invalid VLC (length %u)\n", len);
+ ret = AVERROR_INVALIDDATA;
goto fail;
}
code += 1U << (32 - len);
if (code > UINT32_MAX + 1ULL) {
av_log(logctx, AV_LOG_ERROR, "Overdetermined VLC tree\n");
+ ret = AVERROR_INVALIDDATA;
goto fail;
}
}
ret = vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf);
if (ret < 0)
goto fail;
- return vlc_multi_gen(multi->table, vlc, nb_elems, j, nb_bits, buf, logctx);
+ ret = vlc_multi_gen(multi->table, vlc, nb_elems, j, nb_bits, buf, logctx);
fail:
if (buf != localbuf)
av_free(buf);
- return AVERROR_INVALIDDATA;
+ return ret;
}
void ff_vlc_free_multi(VLC_MULTI *vlc)
--
2.42.0
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
