PR #21106 opened by oliverchang URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21106 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21106.patch
Fixes a heap-buffer-overflow in `libavcodec/dpx.c` triggered by a stale `unpadded_10bit` flag in the `DPXDecContext`. This flag, set for 10-bit unpadded frames, persisted across `decode_frame` calls. If a subsequent frame was 16-bit, the stale flag caused incorrect buffer size validation, allowing truncated buffers to pass checks designed for smaller 10-bit packed data. This led to an out-of-bounds read in `av_image_copy_plane` during 16-bit decoding. The fix explicitly resets `dpx->unpadded_10bit = 0` at the start of `decode_frame` to ensure correct validation for each frame. Fixes: https://issues.oss-fuzz.com/issues/464471792 >From 4154373156a9798bbbe632fc1318efb256792816 Mon Sep 17 00:00:00 2001 From: Oliver Chang <[email protected]> Date: Fri, 5 Dec 2025 02:07:10 +0000 Subject: [PATCH] avcodec/dpx: Fix heap-buffer-overflow in 16-bit decoding Fixes a heap-buffer-overflow in `libavcodec/dpx.c` triggered by a stale `unpadded_10bit` flag in the `DPXDecContext`. This flag, set for 10-bit unpadded frames, persisted across `decode_frame` calls. If a subsequent frame was 16-bit, the stale flag caused incorrect buffer size validation, allowing truncated buffers to pass checks designed for smaller 10-bit packed data. This led to an out-of-bounds read in `av_image_copy_plane` during 16-bit decoding. The fix explicitly resets `dpx->unpadded_10bit = 0` at the start of `decode_frame` to ensure correct validation for each frame. Fixes: https://issues.oss-fuzz.com/issues/464471792 --- libavcodec/dpx.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/dpx.c b/libavcodec/dpx.c index 7355b50f7a..429290aede 100644 --- a/libavcodec/dpx.c +++ b/libavcodec/dpx.c @@ -280,6 +280,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *p, int *got_frame, AVPacket *avpkt) { DPXDecContext *dpx = avctx->priv_data; + dpx->unpadded_10bit = 0; enum AVPixelFormat pix_fmt; const uint8_t *buf = avpkt->data; -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
