From patchwork Tue Sep 26 07:47:34 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paul B Mahol X-Patchwork-Id: 43913 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:2a18:b0:15d:8365:d4b8 with SMTP id e24csp1725421pzh; Tue, 26 Sep 2023 00:48:03 -0700 (PDT) X-Google-Smtp-Source: AGHT+IH4kMSMYXrvBZhn4sthFwAA25MdwQF1mrv0wtbnlVfuIsb//Vb1e6rJKk29NR9wMM3OsPjD X-Received: by 2002:a17:907:7844:b0:98e:26ae:9b07 with SMTP id lb4-20020a170907784400b0098e26ae9b07mr7498692ejc.35.1695714483193; Tue, 26 Sep 2023 00:48:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1695714483; cv=none; d=google.com; s=arc-20160816; b=ypX+8+JTZdEvM7QOkZf5Tcwpu7J4Xm+lHUBBNablZNgfevCZwZOGm1JOlCFYaFyJoZ m8b7B5Dx/TYzL9G9HMTyfGVYSnjp1+EC5jXydk0f+c/SiWYsg2gw+5yvITNulpTdG1P3 Rgv+0OOHPF/D4LqA4lcZZfZDmYp8F49ulpJ/CAezvSzjgHlx5l9aZ3nn361YMNGrQblq Lpozpb0cNJv/lS/gs/q0NFfNx1Ld38X9dXmLS/b4OFPLtsAAR7PKGHDHEQLfybgjK0Jh SEi88Lc4TRO3dK3nYX7fBybWlV28JkQwM1dAsVkJUFsG8YLFY2i6IjpCkYiEqD1sU9qv FiaA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence:subject:to :message-id:date:from:mime-version:dkim-signature:delivered-to; bh=zMi/5NTMUspujZA9mJuKVopNw4tDFn/HU//V3WUmsm4=; fh=e5zN9xSzcxLA6bGo3lF+CqTbY/oLwzApV03EO/RBfgQ=; b=TtdHaM1AQG+Mt0WUMXS/c1PXpheCvcygfJdkdCMLtKbsXuS+IQsvJSZmcI/9HN3moE A8NF4BCrsYpPRpjTk+Psh8ys3wkxWHxap+NansHcZ7L8besIPkpqdVly4MqkQTkT8Slp 9xxwBmxUNPqsZskujGlrkcbYe+MZu5OuVwAaUGGfoesBF016EUVRsKHx/oH0Zu4Z0U90 gTfus8nfKqbc6LrCbuofbrV+dYqCUPljj6VFIW3+c9jo44Nvkzb0Z7YpmNXQ7ibcYbwK SzUjEHzkU8xPU37t5vAKTuPyvIaKnnCcUSKfVgLW6LktuFkGBCKEJW0pV6cSY0rVGcra YWTQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20230601 header.b=VO8QWz91; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id f5-20020a170906560500b009930c0374basi10807974ejq.632.2023.09.26.00.48.02; Tue, 26 Sep 2023 00:48:03 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20230601 header.b=VO8QWz91; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id AB83968C9ED; Tue, 26 Sep 2023 10:47:58 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-ua1-f50.google.com (mail-ua1-f50.google.com [209.85.222.50]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 29EC568C822 for ; Tue, 26 Sep 2023 10:47:52 +0300 (EEST) Received: by mail-ua1-f50.google.com with SMTP id a1e0cc1a2514c-7a52a1e2a59so3088564241.0 for ; Tue, 26 Sep 2023 00:47:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1695714470; x=1696319270; darn=ffmpeg.org; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=XxGew68CAdOAvkQqcyjUrsDkoktZZCZDqvigR+iwdkI=; b=VO8QWz91b2ppF+Jj2WHQvKiScyQdSm8Z6+zCGIhwgsWKk9oX0760e042zNWMN/w+hy ++iTiHmU3UZmlSHAyhFW0TkFP3TFW5FRLWEbwGrpFvQaUoRy1RvIjDicWLivkBMaNA9d jBq3mJMqA8A+MCQmbYzPp94DzgdEL201U5I6xRCp73Lpf9I4ZOzVvukervXn+Y6L97a1 2O3ebPVxvr8yafVZtYmixoisGxw/Y/44HA/M/N6bbY78CTICSVmpgB6JLGEIIaWanQA7 zgVfm/P0w7Mvb1PvbDUh5Wl7y6gtw/28k8GG9hRCL/S0EN7isUVb4sgGhMXAxbG4RKAx /0qw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1695714470; x=1696319270; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=XxGew68CAdOAvkQqcyjUrsDkoktZZCZDqvigR+iwdkI=; b=eRFAcFzjpQSPueBBr/lL4zyJgk+zDdlbES0JamKn3s6RQ939Pgr8oI90HkOGf9B3Xg Kt8iNsddyDXDsebyZ9+zcVYVb+6EuSzaJDRFFGKR4TBstUfmp0bzo9dRksF4XYe7zM4S VTjrAq85X5J5+9xPKDmkW6Vo/ssDtArnDnCm/Mjg4b4thLLE+LUVOtiRUItydliVrSGj PfGYR+f79CNg3oUvoD2svcmrezM3JKlnK+n95N+S4kkokyrETebXTbbK5XccxaVwgMqB v9maOqqEBdB59KTvIeGcigrfM11g6npC9ldpEZ7RuHMba3kwknR1gwvZcudNt1zEKzsg J5oQ== X-Gm-Message-State: AOJu0YzcSZR+ju9REo5q/ZIQ+pyeXgVYEiLNiLJdyHyOilCfsEM37ewD Ziqsuhgrljxui7hXbDHLq1H0wRmXbBHoKx4ocFRQ+1DlTh4= X-Received: by 2002:a05:6102:11e6:b0:44d:5105:b143 with SMTP id e6-20020a05610211e600b0044d5105b143mr5647388vsg.27.1695714470284; Tue, 26 Sep 2023 00:47:50 -0700 (PDT) MIME-Version: 1.0 From: Paul B Mahol Date: Tue, 26 Sep 2023 09:47:34 +0200 Message-ID: To: FFmpeg development discussions and patches X-Content-Filtered-By: Mailman/MimeDel 2.1.29 Subject: [FFmpeg-devel] [PATCH] avcodec/vlc: fix heap use after free X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: eFoKttTg4+Cx Attached. From d0b6b08b38e5f4314f046118bff70d1e08b46bbf Mon Sep 17 00:00:00 2001 From: Paul B Mahol Date: Tue, 26 Sep 2023 09:37:12 +0200 Subject: [PATCH] avcodec/vlc: fix heap use after free Signed-off-by: Paul B Mahol --- libavcodec/vlc.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/libavcodec/vlc.c b/libavcodec/vlc.c index 3b66c94354..2b7535c2ce 100644 --- a/libavcodec/vlc.c +++ b/libavcodec/vlc.c @@ -237,8 +237,6 @@ static int vlc_common_end(VLC *vlc, int nb_bits, int nb_codes, VLCcode *codes, av_log(NULL, AV_LOG_ERROR, "needed %d had %d\n", vlc->table_size, vlc->table_allocated); av_assert0(ret >= 0); } else { - if (codes != localbuf) - av_free(codes); if (ret < 0) { av_freep(&vlc->table); return ret; @@ -299,8 +297,11 @@ int ff_vlc_init_sparse(VLC *vlc, int nb_bits, int nb_codes, COPY(len && len <= nb_bits); nb_codes = j; - return vlc_common_end(vlc, nb_bits, nb_codes, buf, + ret = vlc_common_end(vlc, nb_bits, nb_codes, buf, flags, localbuf); + if (buf != localbuf) + av_free(buf); + return ret; } int ff_vlc_init_from_lengths(VLC *vlc, int nb_bits, int nb_codes, @@ -335,19 +336,21 @@ int ff_vlc_init_from_lengths(VLC *vlc, int nb_bits, int nb_codes, continue; if (len > len_max || code & ((1U << (32 - len)) - 1)) { av_log(logctx, AV_LOG_ERROR, "Invalid VLC (length %u)\n", len); + ret = AVERROR_INVALIDDATA; goto fail; } code += 1U << (32 - len); if (code > UINT32_MAX + 1ULL) { av_log(logctx, AV_LOG_ERROR, "Overdetermined VLC tree\n"); + ret = AVERROR_INVALIDDATA; goto fail; } } - return vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf); + ret = vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf); fail: if (buf != localbuf) av_free(buf); - return AVERROR_INVALIDDATA; + return ret; } static void add_level(VLC_MULTI_ELEM *table, const int nb_elems, @@ -463,22 +466,24 @@ int ff_vlc_init_multi_from_lengths(VLC *vlc, VLC_MULTI *multi, int nb_bits, int continue; if (len > len_max || code & ((1U << (32 - len)) - 1)) { av_log(logctx, AV_LOG_ERROR, "Invalid VLC (length %u)\n", len); + ret = AVERROR_INVALIDDATA; goto fail; } code += 1U << (32 - len); if (code > UINT32_MAX + 1ULL) { av_log(logctx, AV_LOG_ERROR, "Overdetermined VLC tree\n"); + ret = AVERROR_INVALIDDATA; goto fail; } } ret = vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf); if (ret < 0) goto fail; - return vlc_multi_gen(multi->table, vlc, nb_elems, j, nb_bits, buf, logctx); + ret = vlc_multi_gen(multi->table, vlc, nb_elems, j, nb_bits, buf, logctx); fail: if (buf != localbuf) av_free(buf); - return AVERROR_INVALIDDATA; + return ret; } void ff_vlc_free_multi(VLC_MULTI *vlc) -- 2.42.0