PR #22760 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22760 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22760.patch
Fixes: out of array read Fixes: tdsc_tile_dim_mismatch.avi Fixes: tdsc_war_groom_far4096.avi Found-by: Ante Silovic <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> >From 00c28c7fda5547b780065c18905238c145a04818 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 8 Apr 2026 11:17:47 +0200 Subject: [PATCH 1/4] avcodec/tdsc: Check tile_size Fixes: out of array read Fixes: tdsc_war_groom_far4096.avi Found by: Ante Silovic <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/tdsc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/tdsc.c b/libavcodec/tdsc.c index 225ddf3701..e7b00f6c98 100644 --- a/libavcodec/tdsc.c +++ b/libavcodec/tdsc.c @@ -435,6 +435,9 @@ static int tdsc_decode_tiles(AVCodecContext *avctx, int number_tiles) if (ret < 0) return ret; } else if (tile_mode == MKTAG(' ','W','A','R')) { + if (3LL * w * h > tile_size) + return AVERROR_INVALIDDATA; + /* Just copy the buffer to output */ av_image_copy_plane(ctx->refframe->data[0] + x * 3 + ctx->refframe->linesize[0] * y, -- 2.52.0 >From 90629e0ba7dd242586cffe070ed787023ee7b409 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 8 Apr 2026 11:39:55 +0200 Subject: [PATCH 2/4] avcodec/tdsc: Prettier uncompress() check Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/tdsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/tdsc.c b/libavcodec/tdsc.c index e7b00f6c98..104a45285d 100644 --- a/libavcodec/tdsc.c +++ b/libavcodec/tdsc.c @@ -546,7 +546,7 @@ static int tdsc_decode_frame(AVCodecContext *avctx, AVFrame *frame, /* Frames are deflated, need to inflate them first */ ret = uncompress(ctx->deflatebuffer, &dlen, avpkt->data, avpkt->size); - if (ret) { + if (ret != Z_OK) { av_log(avctx, AV_LOG_ERROR, "Deflate error %d.\n", ret); return AVERROR_UNKNOWN; } -- 2.52.0 >From 4a0faab08916cbee0a1573c6bcfec50820267cc5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 8 Apr 2026 12:23:16 +0200 Subject: [PATCH 3/4] avcodec/tdsc: Check jpeg size Fixes: out of array read Fixes: tdsc_tile_dim_mismatch.avi Found-by: Ante Silovic <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/tdsc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/tdsc.c b/libavcodec/tdsc.c index 104a45285d..985ed405fc 100644 --- a/libavcodec/tdsc.c +++ b/libavcodec/tdsc.c @@ -358,7 +358,8 @@ static int tdsc_decode_jpeg_tile(AVCodecContext *avctx, int tile_size, } ret = avcodec_receive_frame(ctx->jpeg_avctx, ctx->jpgframe); - if (ret < 0 || ctx->jpgframe->format != AV_PIX_FMT_YUVJ420P) { + if (ret < 0 || ctx->jpgframe->format != AV_PIX_FMT_YUVJ420P || + w > ctx->jpgframe->width || h > ctx->jpgframe->height) { av_log(avctx, AV_LOG_ERROR, "JPEG decoding error (%d).\n", ret); -- 2.52.0 >From 8a0f29a5d86e10fae7d7a6e9912000488f8d639e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 8 Apr 2026 13:49:28 +0200 Subject: [PATCH 4/4] avcodec/tdsc: Better input size check Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/tdsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/tdsc.c b/libavcodec/tdsc.c index 985ed405fc..88ff575f99 100644 --- a/libavcodec/tdsc.c +++ b/libavcodec/tdsc.c @@ -403,7 +403,7 @@ static int tdsc_decode_tiles(AVCodecContext *avctx, int number_tiles) } tile_size = bytestream2_get_le32(&ctx->gbc); - if (bytestream2_get_bytes_left(&ctx->gbc) < tile_size) + if (bytestream2_get_bytes_left(&ctx->gbc) < tile_size + 24LL) return AVERROR_INVALIDDATA; tile_mode = bytestream2_get_le32(&ctx->gbc); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
