Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
(cherry picked from commit e2bc6d88cd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: use of uninitialized memory
Fixes: screenpresso_short_zlib_heap_disclosure.avi
Fixes: ksUBwBOjJodq
Found-by: Adrian Junge (vurlo)
(cherry picked from commit 7058900614)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fix: vulnerability:019f3b84-903b-75fb-a8de-fad1c2d7e99c
The parse_playlist() path for opening a new child playlist (in == NULL)
directly called c->ctx->io_open(), bypassing the protocol whitelist and
file-extension checks that open_url() enforces. This allowed child URLs
from a master playlist to use protocols other than file/http/data or to
have disallowed extensions.
Route the !in branch through open_url() so that all child playlists are
subject to the same security policy as segment URLs.
Fixes a security bypass in HLS master playlist parsing.
Found-by: depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 23602df9cd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fix: vulnerability:019f3b84-903b-75fb-a8de-fe6f84d6bc32
When parsing IV=0x... followed by a comma, end - ptr was passed directly
to av_strlcpy() as the destination size. Since iv_string is only 33 bytes
(KEYSIZE*2 + 1), a long IV token could overflow into adjacent heap data.
Use FFMIN(end - ptr + 1, sizeof(buf)) to cap the copy size to the actual
buffer size. Apply the same fix to key_uri parsing for consistency.
Fixes a heap buffer overflow in append_list mode when reading an existing
playlist with a crafted IV or URI token length.
Found-by: depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 275e217b10)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
fix: vulnerability:019f3b84-90fb-737a-ae7a-b3e0219266fc
extract_segment_number() used strrchr(filename, '.') and immediately did
dot - 1 without checking for NULL. A segment URI with no extension would
cause undefined behavior (NULL pointer arithmetic) when resuming an
append_list playlist with subtitle variants.
Add a NULL check and return -1 early when no dot is found.
Fixes a crash/UB in HLS muxer resume path.
Found-by: depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 601d9ee881)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
parse_dat(), parse_cube(), and parse_cinespace() multiply an untrusted LUT size
before allocate_3dlut() validates it, which can overflow int.
Use the validated lutsize2 computed by allocate_3dlut() instead.
Fixes: signed integer overflow
(cherry picked from commit 92cd5c9781)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: 9aj_hqdn3d_dynamic_res.mjpg / 9aj_generate_hqdn3d_dynamic_res_mjpg.py
Fixes: wWDsy2oDvMuR
Found-by: Adrian Junge (vurlo) <adjun37@gmail.com>
(cherry picked from commit f0f634b658)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The output stream no longer has Atmos metadata, so the
AV_PROFILE_TRUEHD_ATMOS profile, if it was set, is no longer valid.
Fixes issue #23195.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 86940d45af)
The output stream no longer has Atmos metadata, so the
AV_PROFILE_EAC3_DDP_ATMOS profile, if it was set, is no longer valid.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit c77c0e580a)
The check on variable subblock durations had an inverted comparison, rejecting valid multi-subblock parameters and failing to catch subblock durations exceeding the remaining time.
(cherry picked from commit 1635b49b80402c8cec39eefb12f35e2ee7c13606)
The documentation for get_buffer2() states:
"This callback must use the frame values, not the codec context values, to
calculate the required buffer size."
Fixes wrong output on hbd LCEVC enhanced samples where the base stream is
8bit.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit e1c1b6c558)
If the estimated EXIF size based on the attached frame data is lower
than the actual EXIF size after sanitizing the IFD, then an overrun
might occur. Instead, we parse the IFD and use the parsed size as the
estimated exif size so there won't be any discrepancy between the two
values.
Signed-off-by: Leo Izen <leo.izen@gmail.com>
Reported-by: Adrian Junge <adjun37@gmail.com>
(cherry picked from commit b506fafec9)
tls_mbedtls verifies the peer certificate manually via
mbedtls_ssl_get_verify_result() (it uses MBEDTLS_SSL_VERIFY_OPTIONAL), but
only in tls_open(). On the external-socket path (external_sock=1) tls_open()
skips the handshake; it then runs later through the url_handshake hook,
tls_handshake(), which never checks the verification result, so with verify=1
an untrusted peer certificate would be accepted.
The only in-tree user of this path is the WHIP muxer, which sets verify=0
(WebRTC binds the peer via the SDP a=fingerprint, not a CA), so this is not
reachable today. This change is defence-in-depth: it makes tls_handshake()
honor verify symmetrically with the existing tls_open() check.
Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>
(cherry picked from commit b96701098f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
In `discard_samples()`, the rescaling operation can evaluate to
AV_NOPTS_VALUE if the rescaling operation overflows. This commit
prevents adjusting timestamp and durations by the invalid value.
(cherry picked from commit 005e963c85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This variant is easy backportable but is concatdec specific
Fixes: self_ref.ffconcat
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Rediscovered-by: Anxious Koisi
Fixes: RWHkT0ASFMNI
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 58d39e99e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: poc.hevc / make_poc.py
Fixes: 83WY4xnR87vb
Fixes: dad354f38d (avcodec/hevc: Check max ctb addresses for WPP)
Found-by: VulnForge Security Research Team <haoyuliu@clouditera.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ba55f425fd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: 7aj_swaprect_odd17_nv12.nut / 7aj_generate_swaprect_odd17_nv12.py
Fixes: VRAXYvKtmKa8
Found-by: Adrian Junge (vurlo) <adjun37@gmail.com>
(cherry picked from commit a7e38b617b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: 8aj_floodfill_dynamic_size.pgm / 8aj_generate_floodfill_dynamic_size_pgm.py
Fixes: 3MleMXjGZvu3
Found-by: Adrian Junge (vurlo) <adjun37@gmail.com>
(cherry picked from commit 24c322fdb2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: 2jy_poc_codec2.zip / poc_codec2.raw
Fixes: jOQASNnOm6O7
Found-by: Jiale Yao <yaojiale02@163.com>
(cherry picked from commit 705ff11c2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Use the maximum block dimensions decode_block() can assign after clipping
the nominal tile or scanline block to the data window.
Fixes: Timeout
Fixes: 521392254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_DEC_fuzzer-6740984590565376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 206f2d92db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
When creating nested directories (e.g. /a/b/c), a genuine mkdir()
failure for an intermediate component was overwritten by later
attempts, making the original failure harder to diagnose.
Stop immediately on intermediate errors other than EEXIST, preserving
errno for the caller. Existing path components remain non-fatal, as
required by mkdir -p semantics. Add a regression test for creating a
child below an existing parent directory.
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
(cherry picked from commit a6ed750664)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Each pending packet consumes up to poc_diff tree nodes when it is
output, so the packets in the FIFO can consume at most nb_pending nodes
in total. Frames whose tree lookup misses on output leave their nodes
behind, and damaged or crafted streams can make that happen
indefinitely, growing the tree without limit.
Track the node count and insertion order, keep the leftovers of up to
MAX_DAMAGED_FRAMES frames and beyond that evict the nodes unconsumed
the longest. Timestamps of valid frames are unaffected unless more
frames than that are damaged. No eviction is done at EOF, where nodes
are deliberately kept to regenerate timestamps from.
Of all h264/hevc conformance samples only MR3_TANDBERG_B.264 triggers
evictions, and no sample changes output.
Fixes: unbounded memory growth with damaged streams
Co-Authored-By: Fable-5
(cherry picked from commit dd941af8ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
alloc_and_insert_node() inserts the nodes for 2nd fields with
duration / poc_diff added to the timestamp, but the removal loop
compared all nodes of a frame against the unadjusted first timestamp,
so 2nd field nodes never matched and stayed in the tree until close.
Advance the compared timestamp the same way the insertion does.
Fixes: tree nodes leaking on every field coded frame
Co-Authored-By: Fable-5
(cherry picked from commit 4133db39b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
hevc_queue_frame() collected all tree nodes of the current gop into a
fixed nodes[HEVC_MAX_DPB_SIZE * 2] array and asserted the count stayed
within it. For a crafted HEVC stream the tree can hold slightly more
same-gop nodes than that estimate (observed 34 vs 32), tripping the
av_assert0 and aborting. Link the matching nodes into a list through a
next pointer in the node instead; this has no size limit and needs
neither extra passes nor allocation.
Fixes: assertion failure
Fixes: 519466146/clusterfuzz-testcase-minimized-ffmpeg_BSF_DTS2PTS_fuzzer-5238235193475072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Co-Authored-By: Fable-5
(cherry picked from commit 501d8eb62d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Since bc1a3bfd2c, missing reference
pictures are not replaced with generated pictures unless `-flags
show_corrupt` is used. For `ST_FOLL`/`LT_FOLL` reference pictures,
however, generation of missing references is required by the spec per
8.3.3. We should not require the `show_corrupt` flag to be used in
order to be spec-conformant, so this patch removes the `show_corrupt`
behaviour added in bc1a3bfd2c for
`ST_FOLL`/`LT_FOLL` references and instead unconditionally generates
reference pictures in these sets when unavailable
Fixes: NUT_A_ericsson_5
Fixes: RPS_D_ericsson_6
(cherry picked from commit 265d39e551)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Two runtime paths could compute out-of-range source coordinates for
degenerate projection geometry, causing heap-buffer-overflow reads
Fixes: out of array read
Fixes: assertion failure
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a73d648f6e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array read
Fixes: assertion failure
Fixes: mQzloVqnivHQ
Found-by: Anthony Hurtado
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b3712addc9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Both loops iterate over the same components and compute the same
per-component width and height. The order of tabs within a TabList
does not matter, so build all pixel buffer tabs in a single loop.
(cherry picked from commit df2649ffb1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: playlist.m3u8 / make_poc.py
Fixes: rJ50u41V7ctk
Fixes: ff958b3846 (libavformat/hls: add support for decryption of HLS media segments encrypted using SAMPLE-AES encryption method)
Found-by: Clouditera Security Research Team <haoyuliu@clouditera.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 976490dcc3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
