diff mbox series

[FFmpeg-devel] avcodec/vlc: fix heap use after free

Message ID CAPYw7P5RjskOM0nrpRR5OCR4D2Drs=uVGdBX1t1C4mz_9-6QHA@mail.gmail.com
State New
Headers show
Series [FFmpeg-devel] avcodec/vlc: fix heap use after free | expand

Checks

Context Check Description
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Paul B Mahol Sept. 26, 2023, 7:47 a.m. UTC 
Attached.

Comments

Andreas Rheinhardt Sept. 26, 2023, 9:28 a.m. UTC | #1 
Paul B Mahol:
> Attached.
> 

Michael already sent a less intrusive patch for this:
https://ffmpeg.org/pipermail/ffmpeg-devel/2023-September/314376.html

- Andreas
diff mbox series

Patch

From d0b6b08b38e5f4314f046118bff70d1e08b46bbf Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Tue, 26 Sep 2023 09:37:12 +0200
Subject: [PATCH] avcodec/vlc: fix heap use after free

Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
 libavcodec/vlc.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/libavcodec/vlc.c b/libavcodec/vlc.c
index 3b66c94354..2b7535c2ce 100644
--- a/libavcodec/vlc.c
+++ b/libavcodec/vlc.c
@@ -237,8 +237,6 @@  static int vlc_common_end(VLC *vlc, int nb_bits, int nb_codes, VLCcode *codes,
             av_log(NULL, AV_LOG_ERROR, "needed %d had %d\n", vlc->table_size, vlc->table_allocated);
         av_assert0(ret >= 0);
     } else {
-        if (codes != localbuf)
-            av_free(codes);
         if (ret < 0) {
             av_freep(&vlc->table);
             return ret;
@@ -299,8 +297,11 @@  int ff_vlc_init_sparse(VLC *vlc, int nb_bits, int nb_codes,
     COPY(len && len <= nb_bits);
     nb_codes = j;
 
-    return vlc_common_end(vlc, nb_bits, nb_codes, buf,
+    ret = vlc_common_end(vlc, nb_bits, nb_codes, buf,
                           flags, localbuf);
+    if (buf != localbuf)
+        av_free(buf);
+    return ret;
 }
 
 int ff_vlc_init_from_lengths(VLC *vlc, int nb_bits, int nb_codes,
@@ -335,19 +336,21 @@  int ff_vlc_init_from_lengths(VLC *vlc, int nb_bits, int nb_codes,
             continue;
         if (len > len_max || code & ((1U << (32 - len)) - 1)) {
             av_log(logctx, AV_LOG_ERROR, "Invalid VLC (length %u)\n", len);
+            ret = AVERROR_INVALIDDATA;
             goto fail;
         }
         code += 1U << (32 - len);
         if (code > UINT32_MAX + 1ULL) {
             av_log(logctx, AV_LOG_ERROR, "Overdetermined VLC tree\n");
+            ret = AVERROR_INVALIDDATA;
             goto fail;
         }
     }
-    return vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf);
+    ret = vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf);
 fail:
     if (buf != localbuf)
         av_free(buf);
-    return AVERROR_INVALIDDATA;
+    return ret;
 }
 
 static void add_level(VLC_MULTI_ELEM *table, const int nb_elems,
@@ -463,22 +466,24 @@  int ff_vlc_init_multi_from_lengths(VLC *vlc, VLC_MULTI *multi, int nb_bits, int
             continue;
         if (len > len_max || code & ((1U << (32 - len)) - 1)) {
             av_log(logctx, AV_LOG_ERROR, "Invalid VLC (length %u)\n", len);
+            ret = AVERROR_INVALIDDATA;
             goto fail;
         }
         code += 1U << (32 - len);
         if (code > UINT32_MAX + 1ULL) {
             av_log(logctx, AV_LOG_ERROR, "Overdetermined VLC tree\n");
+            ret = AVERROR_INVALIDDATA;
             goto fail;
         }
     }
     ret = vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf);
     if (ret < 0)
         goto fail;
-    return vlc_multi_gen(multi->table, vlc, nb_elems, j, nb_bits, buf, logctx);
+    ret = vlc_multi_gen(multi->table, vlc, nb_elems, j, nb_bits, buf, logctx);
 fail:
     if (buf != localbuf)
         av_free(buf);
-    return AVERROR_INVALIDDATA;
+    return ret;
 }
 
 void ff_vlc_free_multi(VLC_MULTI *vlc)
-- 
2.42.0