Fixes: invalid free
Fixes: 6Qd6MOq0EvLi
Found-by: Gabe Sherman (Trail of Bits)
(cherry picked from commit 094a2f8a2a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
fix issue: issues/23057 POC4
In refresh_manifest(), when timelines are present, fragment_timescale is
used as the denominator to compute currentTime. If fragment_timescale is
zero (e.g., timescale attribute missing from a crafted manifest with
SegmentTimeline), this results in a division by zero.
Add fragment_timescale > 0 guard to both the video and audio timeline
processing paths to prevent the crash.
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 6a351a3113)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
the genh demuxer had the same short-read issue at one location. the read is now performed with `ffio_read_size()` so truncated input is rejected instead of leaving uninitialized data in the extradata.
`ff_alloc_extradata()` also had its return value unchecked. if allocation failed, the code could dereference a null pointer. the return value is now checked.
the affected path is capped at two channels, so the potential information leak is relatively small, but it is the same underlying bug class.
Signed-off-by: unfunnyatearug <yalisib2222@gmail.com>
(cherry picked from commit 4b47405e1c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
In buf_realloc, os->bufsize is unsigned int and the code doubles it:
nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE);
When os->bufsize exceeds UINT_MAX/2, the multiplication overflows
to a small value, av_realloc returns a tiny buffer, and the subsequent
page write in ogg_read_page goes out of bounds.
Reject the reallocation before the overflow can occur. The largest
safe value is (UINT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 2.
Signed-off-by: age5000 <age5000@proton.me>
(cherry picked from commit d7d119bbe2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
mov_read_keys() allocated (count + 1) pointers from the 32 bit entry
count of the keys atom before reading a single key record, so a 56 byte
file declaring 16777216 keys made ffprobe allocate and zero 128 MiB.
Every key record takes at least 8 bytes, so a count above atom.size / 8
cannot be satisfied and is rejected before the allocation.
Fixes: unbounded allocation
Fixes: poc-keys-count-16777216.mp4
Fixes: hKO4f7GYoUd0
Found-by: He Huang, discovery assisted by NexusSan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 67926e6667)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
For IP-literal hosts mbedtls_ssl_set_hostname() was skipped, so a
CA-trusted certificate for an unrelated name was accepted with no CN/SAN
check. Set the name for numeric hosts too; mbedTLS matches IP literals
against iPAddress SANs.
Fixes: certificate host mismatch accepted for IP-literal hosts (CWE-297)
Fixes: oLS26nsaOqUr
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 57a2e704b4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
vpk_read_packet() divides last_block_size and block_align by
codecpar->ch_layout.nb_channels when assembling the last interleaved
block. Header parsing already rejects a non-positive channel count,
but a failed avcodec_open2() can later zero the layout through
ff_codec_close() -> av_opt_free(), so the division is reached with a
zero divisor.
Check the channel count again before dividing and return
AVERROR_INVALIDDATA.
Original-patch-by: Kacper Michajłow <kasper93@gmail.com>
Fixes: #24290
Reported-by: Darío Clavijo
Found-by: OSS-Fuzz
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
(cherry picked from commit 780f6efbcf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
avformat_find_stream_info() copies codec parameters from the decoder
context after probing, including when avcodec_open2() has already
failed. A failed avcodec_open2() zeroes the context channel layout via
ff_codec_close() -> av_opt_free(), because ch_layout is an
AV_OPT_TYPE_CHLAYOUT option. That empty layout is then written back
onto codecpar and replaces the value the demuxer had already set from
the container.
This is reachable for codecs such as adpcm_psx that have no parser and
do not set AVSTREAM_PARSE_*: the only source of the channel count is
the demuxer header. It differs from codecs like mp3, where the decoder
is expected to fill the layout.
Restore the container channel layout when it was specified and the
decoder result is unspecified, matching the existing restore of color
metadata in parameters_from_context().
See also:
https://ffmpeg.org/pipermail/ffmpeg-devel/2024-November/335598.htmlFixes: #24290
Fixes: https://issues.oss-fuzz.com/issues/42536474
Reported-by: Darío Clavijo
Found-by: OSS-Fuzz
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
(cherry picked from commit fd6dc624be)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
An attempt to use the space will be done even if the Matroska muxer is
disabled, which will mean data will be written where no space was reserved
for it, (track->blockadditionmapping_offset will be 0, on top of it).
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 5cb31ca5b2)
The lavf AV1 CBS implementation disables metadata, tile lists and padding,
but movenccenc.c sees the default AV1RawOBU definition. On 32-bit MinGW,
the metadata member raises the union alignment from four to eight bytes,
placing obu at offset 16 in the caller instead of offset 12 in CBS.
Consequently AV1 CENC reads the wrong fields and fails to write tiles.
Move the feature definitions into the common lavf CBS header so that the
parser and its callers use the same AV1RawOBU layout. Keep the reduced
set of parsed OBU types.
Add a FATE encryption/decryption test using the existing nonuniform-tile
AV1 sample. The test fails before this change with GCC -m32 -malign-double
(which reproduces the relevant MinGW layout) and passes afterwards with
the same reference on that configuration and AArch64.
Fixes#23069.
Assisted-by: Fairy
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 05bd55ff6e)
vmdvideo_decode_init() loads a 768 byte VGA palette from header offset
28 and scales each entry by 4, so every one of these bytes is 6bit in a
file that carries a video stream. Rejecting a larger value keeps raw
video from being mistaken for VMD: a yuv420p10le file starting with
0x2e 0x03 matches the header size field and then scores the same 50 as
the rawvideo demuxer picked by the .yuv extension, which leaves the
format undetermined and fails the whole conversion.
The 26 files with a video stream on samples.ffmpeg.org/game-formats/
sierra-vmd/ all pass; the 9 audio only ones there hold unrelated data
at offset 28 and are exempted by the width and height test.
Fixes: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/22284
(cherry picked from commit 905ef92f02)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
binka_read_packet() calls avio_read() into a buffer from av_new_packet()
and ignores the return value. packet_alloc() only zeroes the 64-byte
padding; the payload is left uninitialized.
pkt_size is avio_rl16() + 4 (max 65539). On a truncated file the demuxer
still returns 0, so av_read_frame delivers up to 64 KiB of uninitialized
heap per packet. ffmpeg -c copy writes those bytes into the output.
Use ffio_read_size() so a short read fails the packet with
AVERROR_INVALIDDATA. Same class as 29f513a (fsb) and 4b47405 (genh).
Signed-off-by: Paulo Cabral Sanz <paulosanz@poli.ufrj.br>
(cherry picked from commit c2394a0ff3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Don't use values that would extend emum data size.
Fixes: warning: enumerator value which exceeds the range of 'int' is a
C23 extension (2147483648 is too large)
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit e7b9c5fe77)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
mov_flush_fragment() calls ffio_reset_dyn_buf() on mov->mdat_buf when
writing the initial moov. That buffer is allocated lazily on the first
packet, so it is still NULL when the trailer is written before anything
was muxed, and ffio_reset_dyn_buf() dereferences it.
627da1111c replaced ffio_free_dyn_buf(), which tolerates NULL, with
ffio_reset_dyn_buf(), which does not, turning this case into a crash.
This affects every fragmented mode that defers the initial moov to the
first flush.
Skip the block entirely when the buffer was never opened. Nothing
references the empty mdat it would otherwise write, as no samples were
muxed.
Reproduced with:
ffmpeg -f lavfi -i color=s=64x64 -frames:v 0 -movflags +frag_keyframe out.mp4
Fixes: 627da1111c ("libavformat/movenc: Uses dynamic buffers for fragmented chunks")
Signed-off-by: Ackanir <git.ackanir@gmail.com>
(cherry picked from commit 9f35e220ff)
Fixes: read of uninitialized memory
Fixes: PJaSVrRTt6Kf
Found-by: Eunsoo Kim, Microsoft FORGE Labs
(cherry picked from commit 73130e77dc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: eYvYXUJZbPJ
Regression since: bca30570d2
Found-by: Eunsoo Kim, Microsoft FORGE Labs
(cherry picked from commit c42ac5c566)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(long)obu_size sign-flips values in 0x80000000..0xfffffffd on ILP32/LLP64
targets (32-bit long, e.g. 64-bit Windows), bypassing the size check.
Compare as uint32_t; frame_size is non-negative at this point.
No PoC as the used setup was 64bit specific
(cherry picked from commit b4c199c590)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The is_keyframe sequence-header search loop advanced buf_ptr/rem_size by
num_lebs + obu_size without bounding obu_size against the remaining data
(unlike the main packetization loop). A crafted obu_size (~0x80000010)
wraps the signed rem_size back positive, so the next iteration
dereferences a pointer past the packet. Consume the LEB bytes first, then
reject an OBU larger than the remaining size. Out-of-bounds read reachable
from a crafted AV1 packet muxed to RTP.
Fixes: out of array read
(cherry picked from commit 983dae9c19)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
send_packet() copied an input-derived unit/fragment size into the fixed
rtp_ctx->buf with no bound, overflowing it for a crafted Dirac unit even at
the default packet size. Reject units that do not fit in max_payload_size.
Fixes: out of array access
(cherry picked from commit 1cdeb3c4e7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
A live manifest whose startNumber decreases across a refresh drives
cur_seq_no negative in move_segments(); get_current_fragment() only checked
the upper bound before indexing fragments[]. Add a lower-bound check and
clamp the negative delta at its source.
Fixes: out of array read
(cherry picked from commit 65b0dab903)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
numNalus is uint16_t; a crafted hvcC declaring >65535 NAL units of one
type wraps it to 0 and then writes nal[-1]. Reject before the count can
wrap. Reachable by remuxing a crafted file with -c copy.
Fixes: integer overflow
Fixes: out of array access
(cherry picked from commit acf5d7cdc1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
put_system_header() writes 12 + 3*N bytes after the pack header into a
fixed 128-byte stack buffer, but is handed a PutBitContext sized past the
real buffer, so its own bounds check never fires; ~35+ streams overflow the
stack. Reject at mux init when the system header would not fit.
Fixes: out of array access
Fixes: many.mkv
(cherry picked from commit 9d786e4b5e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
librist_read() ignored its size argument and copied the full payload_len,
overflowing a smaller destination (e.g. via the async: wrapper). Clamp the
copy to the caller-provided buffer size.
Fixes: out of array access
(cherry picked from commit 1c10bcc2e1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
A zero channel count can cause a division by zero in
scd_read_packet().
Reported-by: sdjasj
Fixes#23181.
Signed-off-by: qaq03101 <1440810736@qq.com>
(cherry picked from commit 9c176644aa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
%zu expects a size_t, yet the argument is of type int64_t;
this is UB if size_t unless size_t is the corresponding unsigned
type to int64_t (i.e. it is UB on 32bit systems).
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 844e10e1a7)
AV_RL32() is unsigned, so a skip_samples value below 528 + 1 wraps around
instead of clamping to zero and is written out as a delay of 4095 samples.
(cherry picked from commit 146e0f7b79)
Signed-off-by: Romain Beauxis <romain.beauxis@gmail.com>
The return value of MoveFileExW was not being correctly interpreted,
see https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-movefileexw.
On Windows a failed rename over the file: protocol now surfaces as failed to rename file %s to %s:
Operation not permitted (ff_rename, libavformat/avio.c:867) plus an AVERROR(EPERM) return, where previously the muxer
reported success and the user was left with a missing or stale output file and no diagnostic. This affects the
write-to-temp-then-rename paths in hlsenc, dashenc, hdsenc, smoothstreamingenc, segment, and img2enc (e.g. HLS/DASH
playlist updates, -write_temp_file, segment list finalization).
Also, added unit tests to exercise the rename function.
Signed-off-by: Christopher Decker <chris.decker08@gmail.com>
(cherry picked from commit 94ff335d76)
Co-Authored-by: Fable 5
fix issue: issues/23057 POC1
release seg memory and return NULL if av_strtok return NULL.
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 813c28d1ce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
When computing the segment count for a SegmentTimeline entry with
repeat="-1" (indefinite repeat, typical for live streams), the
expression:
length_of_each_segment = pls->timelines[i]->duration /
pls->fragment_timescale;
num = c->period_duration / length_of_each_segment;
performs two successive integer divisions. The first division
truncates toward zero; if the segment duration in timescale ticks
is smaller than the timescale (duration < fragment_timescale),
length_of_each_segment becomes 0, and the second division triggers
a division by zero.
Fix this by using av_rescale(), which computes
period_duration * fragment_timescale / duration
with 64-bit intermediate precision, avoiding both the truncation
and the zero-division risk. If duration is 0 (invalid manifest),
explicitly fall back to first_seq_no instead of crashing.
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 0c0dd61b8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The current logic would stop demuxing the entire manifest once the first Representation
returned EOF, which could result in plenty of packets from other Representations being
lost.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d9da090b1d)
Based on a patch by Michael Niedermayer
Fixes: unbounded allocation
Fixes: poc_output_mix_config_dos.iamf
Fixes: 387qWpjUgeKH
Found-by: Duong Tran Thai (CyStack)
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d2476bfd2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
RTSP redirects retain URL credentials and authentication state when a
Location URI changes to another origin. This can forward reusable
credentials to a server with a different scheme, host, or port.
Clear the stored credentials and authentication state when the redirect
crosses an origin boundary. Preserve them for same-origin redirects.
Fixes: cross-origin credential disclosure
Fixes: rtsp_redirect_auth_leak_poc.py
Fixes: VaKaPOnfN02z
(cherry picked from commit a441a2eb38)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
