Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2013-7019: Improper Input Validation (CWE-20)
value: The get_cox function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not properly validate the reduction factor, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2013-12-09T16:36Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/jpeg2000dec.c
Commit date: 2013-10-15 14:30:17 +0200
Commit message: avcodec/jpeg2000dec: fix context consistency with too large lowres

Fixes out of array accesses
Fixes Ticket2898

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index ef63d37f0c6..80bc335507f 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -368,15 +368,22 @@ static int get_cox(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c)
     if (c->nreslevels >= JPEG2000_MAX_RESLEVELS) {
         av_log(s->avctx, AV_LOG_ERROR, "nreslevels %d is invalid\n", c->nreslevels);
         return AVERROR_INVALIDDATA;
     }
 
+    if (c->nreslevels <= s->reduction_factor) {
+        /* we are forced to update reduction_factor as its requested value is
+           not compatible with this bitstream, and as we might have used it
+           already in setup earlier we have to fail this frame until
+           reinitialization is implemented */
+        av_log(s->avctx, AV_LOG_ERROR, "reduction_factor too large for this bitstream, max is %d\n", c->nreslevels - 1);
+        s->reduction_factor = c->nreslevels - 1;
+        return AVERROR(EINVAL);
+    }
+
     /* compute number of resolution levels to decode */
-    if (c->nreslevels < s->reduction_factor)
-        c->nreslevels2decode = 1;
-    else
-        c->nreslevels2decode = c->nreslevels - s->reduction_factor;
+    c->nreslevels2decode = c->nreslevels - s->reduction_factor;
 
     c->log2_cblk_width  = (bytestream2_get_byteu(&s->g) & 15) + 2; // cblk width
     c->log2_cblk_height = (bytestream2_get_byteu(&s->g) & 15) + 2; // cblk height
 
     if (c->log2_cblk_width > 10 || c->log2_cblk_height > 10 ||

Vulnerable code:     if (c->nreslevels < s->reduction_factor)
        c->nreslevels2decode = 1;
    else
        c->nreslevels2decode = c->nreslevels - s->reduction_factor;
Fixed code:     if (c->nreslevels <= s->reduction_factor) {
        /* we are forced to update reduction_factor as its requested value is
           not compatible with this bitstream, and as we might have used it
           already in setup earlier we have to fail this frame until
           reinitialization is implemented */
        av_log(s->avctx, AV_LOG_ERROR, "reduction_factor too large for this bitstream, max is %d\n", c->nreslevels - 1);
        s->reduction_factor = c->nreslevels - 1;
        return AVERROR(EINVAL);
    }

    c->nreslevels2decode = c->nreslevels - s->reduction_factor;
CVE-2013-7021: Resource Management Errors (CWE-399)
value: The filter_frame function in libavfilter/vf_fps.c in FFmpeg before 2.1 does not properly ensure the availability of FIFO content, which allows remote attackers to cause a denial of service (double free) or possibly have unspecified other impact via crafted data.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2013-12-09T16:36Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavfilter/vf_fps.c
Commit date: 2013-09-02 04:32:23 +0200
Commit message: avfilter/vf_fps: make sure the fifo is not empty before using it

Fixes Ticket2905

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavfilter/vf_fps.c b/libavfilter/vf_fps.c
index 4eb3663b1a4..06ebdfadce6 100644
--- a/libavfilter/vf_fps.c
+++ b/libavfilter/vf_fps.c
@@ -203,11 +203,11 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *buf)
         }
         return 0;
     }
 
     /* now wait for the next timestamp */
-    if (buf->pts == AV_NOPTS_VALUE) {
+    if (buf->pts == AV_NOPTS_VALUE || av_fifo_size(s->fifo) <= 0) {
         return write_to_fifo(s->fifo, buf);
     }
 
     /* number of output frames */
     delta = av_rescale_q_rnd(buf->pts - s->pts, inlink->time_base,

Vulnerable code:     if (buf->pts == AV_NOPTS_VALUE) {
Fixed code:     if (buf->pts == AV_NOPTS_VALUE || av_fifo_size(s->fifo) <= 0) {
CVE-2013-7022: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The g2m_init_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 does not properly allocate memory for tiles, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Go2Webinar data.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2013-12-09T16:36Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/g2meet.c
Commit date: 2013-09-22 00:04:39 +0200
Commit message: avcodec/g2meet: Fix framebuf size

Currently the code can in some cases draw tiles that hang outside the
allocated buffer. This patch increases the buffer size to avoid out
of array accesses. An alternative would be to fail if such tiles are
encountered.
I do not know if any valid files use such hanging tiles.

Fixes Ticket2971
Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
index ccccf218346..1eae1a49b5d 100644
--- a/libavcodec/g2meet.c
+++ b/libavcodec/g2meet.c
@@ -441,12 +441,12 @@ static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y,
 static int g2m_init_buffers(G2MContext *c)
 {
     int aligned_height;
 
     if (!c->framebuf || c->old_width < c->width || c->old_height < c->height) {
-        c->framebuf_stride = FFALIGN(c->width * 3, 16);
-        aligned_height     = FFALIGN(c->height,    16);
+        c->framebuf_stride = FFALIGN(c->width + 15, 16) * 3;
+        aligned_height     = c->height + 15;
         av_free(c->framebuf);
         c->framebuf = av_mallocz(c->framebuf_stride * aligned_height);
         if (!c->framebuf)
             return AVERROR(ENOMEM);
     }

Vulnerable code:         c->framebuf_stride = FFALIGN(c->width * 3, 16);
        aligned_height     = FFALIGN(c->height,    16);
Fixed code:         c->framebuf_stride = FFALIGN(c->width + 15, 16) * 3;
        aligned_height     = c->height + 15;
CVE-2013-7023: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The ff_combine_frame function in libavcodec/parser.c in FFmpeg before 2.1 does not properly handle certain memory-allocation errors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2013-12-09T16:36Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/parser.c
Commit date: 2013-09-26 21:03:48 +0200
Commit message: avcodec/parser: reset indexes on realloc failure

Fixes Ticket2982

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavcodec/parser.c b/libavcodec/parser.c
index 500bbb8f543..8a825938a65 100644
--- a/libavcodec/parser.c
+++ b/libavcodec/parser.c
@@ -235,12 +235,14 @@ int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s
 
     /* copy into buffer end return */
     if(next == END_NOT_FOUND){
         void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, (*buf_size) + pc->index + FF_INPUT_BUFFER_PADDING_SIZE);
 
-        if(!new_buffer)
+        if(!new_buffer) {
+            pc->index = 0;
             return AVERROR(ENOMEM);
+        }
         pc->buffer = new_buffer;
         memcpy(&pc->buffer[pc->index], *buf, *buf_size);
         pc->index += *buf_size;
         return -1;
     }
@@ -249,13 +251,15 @@ int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s
     pc->overread_index= pc->index + next;
 
     /* append to buffer */
     if(pc->index){
         void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, next + pc->index + FF_INPUT_BUFFER_PADDING_SIZE);
-
-        if(!new_buffer)
+        if(!new_buffer) {
+            pc->overread_index =
+            pc->index = 0;
             return AVERROR(ENOMEM);
+        }
         pc->buffer = new_buffer;
         if (next > -FF_INPUT_BUFFER_PADDING_SIZE)
             memcpy(&pc->buffer[pc->index], *buf,
                    next + FF_INPUT_BUFFER_PADDING_SIZE);
         pc->index = 0;

Vulnerable code:         if(!new_buffer)

        if(!new_buffer)
Fixed code:         if(!new_buffer) {
            pc->index = 0;
        }
        if(!new_buffer) {
            pc->overread_index =
            pc->index = 0;
        }
CVE-2015-3417: Other (NVD-CWE-Other)
value: Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2015-04-24T17:59Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/h264.c
Commit date: 2014-12-17 21:55:45 +0100
Commit message: avcodec/h264: Clear delayed_pic on deallocation

Fixes use of freed memory

Fixes: case5_av_frame_copy_props.mp4
Found-by: Michal Zalewski <lcamtuf@coredump.cx>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index 222bf58b10f..06d8dec82e4 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -389,10 +389,11 @@ void ff_h264_free_tables(H264Context *h, int free_rbsp)
     av_buffer_pool_uninit(&h->ref_index_pool);
 
     if (free_rbsp && h->DPB) {
         for (i = 0; i < H264_MAX_PICTURE_COUNT; i++)
             ff_h264_unref_picture(h, &h->DPB[i]);
+        memset(h->delayed_pic, 0, sizeof(h->delayed_pic));
         av_freep(&h->DPB);
     } else if (h->DPB) {
         for (i = 0; i < H264_MAX_PICTURE_COUNT; i++)
             h->DPB[i].needs_realloc = 1;
     }

Fixed code:         memset(h->delayed_pic, 0, sizeof(h->delayed_pic));
CVE-2016-10191: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2017-02-09T15:59Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/rtmppkt.c
Commit date: 2016-12-05 21:30:12 +0100
Commit message: avformat/rtmppkt: Check for packet size mismatches

Fixes out of array access

Found-by: Paul Cher <paulcher@icloud.com>
Reviewed-by: Paul Cher <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/rtmppkt.c b/libavformat/rtmppkt.c
index 0d693c27f7f..cde0da78ce1 100644
--- a/libavformat/rtmppkt.c
+++ b/libavformat/rtmppkt.c
@@ -233,10 +233,18 @@ static int rtmp_packet_read_one_chunk(URLContext *h, RTMPPacket *p,
         timestamp = ts_field;
     }
     if (hdr != RTMP_PS_TWELVEBYTES)
         timestamp += prev_pkt[channel_id].timestamp;
 
+    if (prev_pkt[channel_id].read && size != prev_pkt[channel_id].size) {
+        av_log(NULL, AV_LOG_ERROR, "RTMP packet size mismatch %d != %d\n",
+                size,
+                prev_pkt[channel_id].size);
+        ff_rtmp_packet_destroy(&prev_pkt[channel_id]);
+        prev_pkt[channel_id].read = 0;
+    }
+
     if (!prev_pkt[channel_id].read) {
         if ((ret = ff_rtmp_packet_create(p, channel_id, type, timestamp,
                                          size)) < 0)
             return ret;
         p->read = written;

Fixed code:     if (prev_pkt[channel_id].read && size != prev_pkt[channel_id].size) {
        av_log(NULL, AV_LOG_ERROR, "RTMP packet size mismatch %d != %d\n",
                size,
                prev_pkt[channel_id].size);
        ff_rtmp_packet_destroy(&prev_pkt[channel_id]);
        prev_pkt[channel_id].read = 0;
    }
CVE-2016-10192: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2017-02-09T15:59Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: ffserver.c
Commit date: 2016-12-05 21:30:12 +0100
Commit message: ffserver: Check chunk size

Fixes out of array access

Fixes: poc_ffserver.py
Found-by: Paul Cher <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/ffserver.c b/ffserver.c
index 3ff761f68f4..02a583464b3 100644
--- a/ffserver.c
+++ b/ffserver.c
@@ -2736,12 +2736,14 @@ static int http_receive_data(HTTPContext *c)
             /* end of connection : close it */
             goto fail;
         } else if (c->buffer_ptr - c->buffer >= 2 &&
                    !memcmp(c->buffer_ptr - 1, "\r\n", 2)) {
             c->chunk_size = strtol(c->buffer, 0, 16);
-            if (c->chunk_size == 0) // end of stream
+            if (c->chunk_size <= 0) { // end of stream or invalid chunk size
+                c->chunk_size = 0;
                 goto fail;
+            }
             c->buffer_ptr = c->buffer;
             break;
         } else if (++loop_run > 10)
             /* no chunk header, abort */
             goto fail;
@@ -2759,10 +2761,11 @@ static int http_receive_data(HTTPContext *c)
                 goto fail;
         } else if (len == 0)
             /* end of connection : close it */
             goto fail;
         else {
+            av_assert0(len <= c->chunk_size);
             c->chunk_size -= len;
             c->buffer_ptr += len;
             c->data_count += len;
             update_datarate(&c->datarate, c->data_count);
         }

Vulnerable code:             if (c->chunk_size == 0) // end of stream
Fixed code:             if (c->chunk_size <= 0) { // end of stream or invalid chunk size
                c->chunk_size = 0;
            }
            av_assert0(len <= c->chunk_size);
CVE-2016-3062: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 8.8
Published: 2016-06-16T18:59Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/mov.c
Commit date: 2012-04-15 23:37:09 +0200
Commit message: mov: reset dref_count on realloc to keep values consistent.

This fixes a potential crash.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavformat/mov.c b/libavformat/mov.c
index 004c4c47ea4..93f369125a2 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -399,10 +399,11 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     avio_rb32(pb); // version + flags
     entries = avio_rb32(pb);
     if (entries >= UINT_MAX / sizeof(*sc->drefs))
         return AVERROR_INVALIDDATA;
     av_free(sc->drefs);
+    sc->drefs_count = 0;
     sc->drefs = av_mallocz(entries * sizeof(*sc->drefs));
     if (!sc->drefs)
         return AVERROR(ENOMEM);
     sc->drefs_count = entries;
 

Fixed code:     sc->drefs_count = 0;
CVE-2017-11719: Out-of-bounds Read (CWE-125)
value: The dnxhd_decode_header function in libavcodec/dnxhddec.c in FFmpeg 3.0 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a crafted DNxHD file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2017-07-28T05:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/dnxhddec.c
Commit date: 2017-07-27 03:07:12 +0200
Commit message: avcodec/dnxhddec: Move mb height check out of non hr branch

Fixes: out of array access
Fixes: poc.dnxhd

Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavcodec/dnxhddec.c b/libavcodec/dnxhddec.c
index 40d41f9bf11..f46e41a4562 100644
--- a/libavcodec/dnxhddec.c
+++ b/libavcodec/dnxhddec.c
@@ -296,18 +296,22 @@ static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame,
 
     // Newer format supports variable mb_scan_index sizes
     if (ctx->mb_height > 68 && ff_dnxhd_check_header_prefix_hr(header_prefix)) {
         ctx->data_offset = 0x170 + (ctx->mb_height << 2);
     } else {
-        if (ctx->mb_height > 68 ||
-            (ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
+        if (ctx->mb_height > 68) {
             av_log(ctx->avctx, AV_LOG_ERROR,
                    "mb height too big: %d\n", ctx->mb_height);
             return AVERROR_INVALIDDATA;
         }
         ctx->data_offset = 0x280;
     }
+    if ((ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
+        av_log(ctx->avctx, AV_LOG_ERROR,
+                "mb height too big: %d\n", ctx->mb_height);
+        return AVERROR_INVALIDDATA;
+    }
 
     if (buf_size < ctx->data_offset) {
         av_log(ctx->avctx, AV_LOG_ERROR,
                "buffer too small (%d < %d).\n", buf_size, ctx->data_offset);
         return AVERROR_INVALIDDATA;

Vulnerable code:         if (ctx->mb_height > 68 ||
            (ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
Fixed code:         if (ctx->mb_height > 68) {
    if ((ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
        av_log(ctx->avctx, AV_LOG_ERROR,
                "mb height too big: %d\n", ctx->mb_height);
        return AVERROR_INVALIDDATA;
    }
CVE-2017-14054: Excessive Iteration (CWE-834)
value: In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted IVR file, which claims a large "len" field in the header but does not contain sufficient backing data, is provided, the first type==4 loop would consume huge CPU resources, since there is no EOF check inside the loop.
CWE description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CVSS v3 base score: 6.5
Published: 2017-08-31T15:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/rmdec.c
Commit date: 2017-08-27 19:23:13 +0200
Commit message: avformat/rmdec: Fix DoS due to lack of eof check

Fixes: loop.ivr

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 178eaea57d8..d6d7d9cd841 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -1221,12 +1221,15 @@ static int ivr_read_header(AVFormatContext *s)
         if (type == 5) {
             avio_get_str(pb, len, val, sizeof(val));
             av_log(s, AV_LOG_DEBUG, "%s = '%s'\n", key, val);
         } else if (type == 4) {
             av_log(s, AV_LOG_DEBUG, "%s = '0x", key);
-            for (j = 0; j < len; j++)
+            for (j = 0; j < len; j++) {
+                if (avio_feof(pb))
+                    return AVERROR_INVALIDDATA;
                 av_log(s, AV_LOG_DEBUG, "%X", avio_r8(pb));
+            }
             av_log(s, AV_LOG_DEBUG, "'\n");
         } else if (len == 4 && type == 3 && !strncmp(key, "StreamCount", tlen)) {
             nb_streams = value = avio_rb32(pb);
         } else if (len == 4 && type == 3) {
             value = avio_rb32(pb);

Vulnerable code:             for (j = 0; j < len; j++)
Fixed code:             for (j = 0; j < len; j++) {
                if (avio_feof(pb))
                    return AVERROR_INVALIDDATA;
            }
CVE-2017-14055: Excessive Iteration (CWE-834)
value: In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
CWE description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CVSS v3 base score: 6.5
Published: 2017-08-31T15:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/mvdec.c
Commit date: 2017-08-27 19:23:37 +0200
Commit message: avformat/mvdec: Fix DoS due to lack of eof check

Fixes: loop.mv

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/mvdec.c b/libavformat/mvdec.c
index 0e12c8c6c18a..f7aa4cbaecf8 100644
--- a/libavformat/mvdec.c
+++ b/libavformat/mvdec.c
@@ -340,10 +340,12 @@ static int mv_read_header(AVFormatContext *avctx)
         timestamp = 0;
         for (i = 0; i < vst->nb_frames; i++) {
             uint32_t pos   = avio_rb32(pb);
             uint32_t asize = avio_rb32(pb);
             uint32_t vsize = avio_rb32(pb);
+            if (avio_feof(pb))
+                return AVERROR_INVALIDDATA;
             avio_skip(pb, 8);
             av_add_index_entry(ast, pos, timestamp, asize, 0, AVINDEX_KEYFRAME);
             av_add_index_entry(vst, pos + asize, i, vsize, 0, AVINDEX_KEYFRAME);
             timestamp += asize / (ast->codecpar->channels * 2);
         }

Fixed code:             if (avio_feof(pb))
                return AVERROR_INVALIDDATA;
CVE-2017-14056: Excessive Iteration (CWE-834)
value: In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large "frame_count" field in the header but does not contain sufficient backing data, is provided, the loops (for offset and size tables) would consume huge CPU and memory resources, since there is no EOF check inside these loops.
CWE description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CVSS v3 base score: 6.5
Published: 2017-08-31T15:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/rl2.c
Commit date: 2017-08-27 19:23:30 +0200
Commit message: avformat/rl2: Fix DoS due to lack of eof check

Fixes: loop.rl2

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/rl2.c b/libavformat/rl2.c
index 0bec8f1d9aba..eb1682dfcb7c 100644
--- a/libavformat/rl2.c
+++ b/libavformat/rl2.c
@@ -168,16 +168,25 @@ static av_cold int rl2_read_header(AVFormatContext *s)
         av_free(chunk_offset);
         return AVERROR(ENOMEM);
     }
 
     /** read offset and size tables */
-    for(i=0; i < frame_count;i++)
+    for(i=0; i < frame_count;i++) {
+        if (avio_feof(pb))
+            return AVERROR_INVALIDDATA;
         chunk_size[i] = avio_rl32(pb);
-    for(i=0; i < frame_count;i++)
+    }
+    for(i=0; i < frame_count;i++) {
+        if (avio_feof(pb))
+            return AVERROR_INVALIDDATA;
         chunk_offset[i] = avio_rl32(pb);
-    for(i=0; i < frame_count;i++)
+    }
+    for(i=0; i < frame_count;i++) {
+        if (avio_feof(pb))
+            return AVERROR_INVALIDDATA;
         audio_size[i] = avio_rl32(pb) & 0xFFFF;
+    }
 
     /** build the sample index */
     for(i=0;i<frame_count;i++){
         if(chunk_size[i] < 0 || audio_size[i] > chunk_size[i]){
             ret = AVERROR_INVALIDDATA;

Vulnerable code:     for(i=0; i < frame_count;i++)
    for(i=0; i < frame_count;i++)
    for(i=0; i < frame_count;i++)
Fixed code:     for(i=0; i < frame_count;i++) {
        if (avio_feof(pb))
            return AVERROR_INVALIDDATA;
    }
    for(i=0; i < frame_count;i++) {
        if (avio_feof(pb))
            return AVERROR_INVALIDDATA;
    }
    for(i=0; i < frame_count;i++) {
        if (avio_feof(pb))
            return AVERROR_INVALIDDATA;
    }
CVE-2017-14057: Excessive Iteration (CWE-834)
value: In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "name_len" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops.
CWE description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CVSS v3 base score: 6.5
Published: 2017-08-31T15:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/asfdec_f.c
Commit date: 2017-08-27 19:21:42 +0200
Commit message: avformat/asfdec: Fix DoS due to lack of eof check

Fixes: loop.asf

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
index be09a92bd1e2..f3acbae2801b 100644
--- a/libavformat/asfdec_f.c
+++ b/libavformat/asfdec_f.c
@@ -747,17 +747,19 @@ static int asf_read_marker(AVFormatContext *s, int64_t size)
     avio_rl64(pb);            // reserved 16 bytes
     avio_rl64(pb);            // ...
     count = avio_rl32(pb);    // markers count
     avio_rl16(pb);            // reserved 2 bytes
     name_len = avio_rl16(pb); // name length
-    for (i = 0; i < name_len; i++)
-        avio_r8(pb); // skip the name
+    avio_skip(pb, name_len);
 
     for (i = 0; i < count; i++) {
         int64_t pres_time;
         int name_len;
 
+        if (avio_feof(pb))
+            return AVERROR_INVALIDDATA;
+
         avio_rl64(pb);             // offset, 8 bytes
         pres_time = avio_rl64(pb); // presentation time
         pres_time -= asf->hdr.preroll * 10000;
         avio_rl16(pb);             // entry length
         avio_rl32(pb);             // send time

Vulnerable code:     for (i = 0; i < name_len; i++)
        avio_r8(pb); // skip the name
Fixed code:     avio_skip(pb, name_len);
        if (avio_feof(pb))
            return AVERROR_INVALIDDATA;
CVE-2017-14059: Excessive Iteration (CWE-834)
value: In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. When a crafted CINE file, which claims a large "duration" field in the header but does not contain sufficient backing data, is provided, the image-offset parsing loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
CWE description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CVSS v3 base score: 6.5
Published: 2017-08-31T15:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/cinedec.c
Commit date: 2017-08-27 19:22:08 +0200
Commit message: avformat/cinedec: Fix DoS due to lack of eof check

Fixes: loop.cine

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/cinedec.c b/libavformat/cinedec.c
index 763b93ba2e17..de34fb963820 100644
--- a/libavformat/cinedec.c
+++ b/libavformat/cinedec.c
@@ -265,12 +265,16 @@ static int cine_read_header(AVFormatContext *avctx)
     set_metadata_int(&st->metadata, "crop_right", avio_rl32(pb), 1);
     set_metadata_int(&st->metadata, "crop_bottom", avio_rl32(pb), 1);
 
     /* parse image offsets */
     avio_seek(pb, offImageOffsets, SEEK_SET);
-    for (i = 0; i < st->duration; i++)
+    for (i = 0; i < st->duration; i++) {
+        if (avio_feof(pb))
+            return AVERROR_INVALIDDATA;
+
         av_add_index_entry(st, avio_rl64(pb), i, 0, 0, AVINDEX_KEYFRAME);
+    }
 
     return 0;
 }
 
 static int cine_read_packet(AVFormatContext *avctx, AVPacket *pkt)

Vulnerable code:     for (i = 0; i < st->duration; i++)
Fixed code:     for (i = 0; i < st->duration; i++) {
        if (avio_feof(pb))
            return AVERROR_INVALIDDATA;

    }
CVE-2017-14169: Improper Input Validation (CWE-20)
value: In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, an integer signedness error might occur when a crafted file, which claims a large "item_num" field such as 0xffffffff, is provided. As a result, the variable "item_num" turns negative, bypassing the check for a large value.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 8.8
Published: 2017-09-07T06:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/mxfdec.c
Commit date: 2017-09-01 01:48:39 +0200
Commit message: avformat/mxfdec: Fix Sign error in mxf_read_primer_pack()

Fixes: 20170829B.mxf

Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com>
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 6adb77d81fbf..91731a7533c1 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -498,11 +498,11 @@ static int mxf_read_primer_pack(void *arg, AVIOContext *pb, int tag, int size, U
 
     if (item_len != 18) {
         avpriv_request_sample(pb, "Primer pack item length %d", item_len);
         return AVERROR_PATCHWELCOME;
     }
-    if (item_num > 65536) {
+    if (item_num > 65536 || item_num < 0) {
         av_log(mxf->fc, AV_LOG_ERROR, "item_num %d is too large\n", item_num);
         return AVERROR_INVALIDDATA;
     }
     if (mxf->local_tags)
         av_log(mxf->fc, AV_LOG_VERBOSE, "Multiple primer packs\n");

Vulnerable code:     if (item_num > 65536) {
Fixed code:     if (item_num > 65536 || item_num < 0) {
CVE-2017-14170: Excessive Iteration (CWE-834)
value: In libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted MXF file, which claims a large "nb_index_entries" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU resources, since there is no EOF check inside the loop. Moreover, this big loop can be invoked multiple times if there is more than one applicable data segment in the crafted MXF file.
CWE description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CVSS v3 base score: 6.5
Published: 2017-09-07T06:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/mxfdec.c
Commit date: 2017-09-01 01:48:35 +0200
Commit message: avformat/mxfdec: Fix DoS issues in mxf_read_index_entry_array()

Fixes: 20170829A.mxf

Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com>
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index f8d0f9e0570b..6adb77d81fbf 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -897,20 +897,24 @@ static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *seg
     int i, length;
 
     segment->nb_index_entries = avio_rb32(pb);
 
     length = avio_rb32(pb);
+    if(segment->nb_index_entries && length < 11)
+        return AVERROR_INVALIDDATA;
 
     if (!(segment->temporal_offset_entries=av_calloc(segment->nb_index_entries, sizeof(*segment->temporal_offset_entries))) ||
         !(segment->flag_entries          = av_calloc(segment->nb_index_entries, sizeof(*segment->flag_entries))) ||
         !(segment->stream_offset_entries = av_calloc(segment->nb_index_entries, sizeof(*segment->stream_offset_entries)))) {
         av_freep(&segment->temporal_offset_entries);
         av_freep(&segment->flag_entries);
         return AVERROR(ENOMEM);
     }
 
     for (i = 0; i < segment->nb_index_entries; i++) {
+        if(avio_feof(pb))
+            return AVERROR_INVALIDDATA;
         segment->temporal_offset_entries[i] = avio_r8(pb);
         avio_r8(pb);                                        /* KeyFrameOffset */
         segment->flag_entries[i] = avio_r8(pb);
         segment->stream_offset_entries[i] = avio_rb64(pb);
         avio_skip(pb, length - 11);

Fixed code:     if(segment->nb_index_entries && length < 11)
        return AVERROR_INVALIDDATA;
        if(avio_feof(pb))
            return AVERROR_INVALIDDATA;
CVE-2017-14171: Excessive Iteration (CWE-834)
value: In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file, which claims a large "table_entries_used" field in the header but does not contain sufficient backing data, is provided, the loop over 'table_entries_used' would consume huge CPU resources, since there is no EOF check inside the loop.
CWE description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CVSS v3 base score: 6.5
Published: 2017-09-07T06:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/nsvdec.c
Commit date: 2017-09-01 01:48:31 +0200
Commit message: avformat/nsvdec: Fix DoS due to lack of eof check in nsvs_file_offset loop.

Fixes: 20170829.nsv

Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com>
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c
index c6ddb67bbddc..d8ce656817ca 100644
--- a/libavformat/nsvdec.c
+++ b/libavformat/nsvdec.c
@@ -333,12 +333,15 @@ static int nsv_parse_NSVf_header(AVFormatContext *s)
             return -1;
         nsv->nsvs_file_offset = av_malloc_array((unsigned)table_entries_used, sizeof(uint32_t));
         if (!nsv->nsvs_file_offset)
             return AVERROR(ENOMEM);
 
-        for(i=0;i<table_entries_used;i++)
+        for(i=0;i<table_entries_used;i++) {
+            if (avio_feof(pb))
+                return AVERROR_INVALIDDATA;
             nsv->nsvs_file_offset[i] = avio_rl32(pb) + size;
+        }
 
         if(table_entries > table_entries_used &&
            avio_rl32(pb) == MKTAG('T','O','C','2')) {
             nsv->nsvs_timestamps = av_malloc_array((unsigned)table_entries_used, sizeof(uint32_t));
             if (!nsv->nsvs_timestamps)

Vulnerable code:         for(i=0;i<table_entries_used;i++)
Fixed code:         for(i=0;i<table_entries_used;i++) {
            if (avio_feof(pb))
                return AVERROR_INVALIDDATA;
        }
CVE-2017-14222: Excessive Iteration (CWE-834)
value: In libavformat/mov.c in FFmpeg 3.3.3, a DoS in read_tfra() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MOV file, which claims a large "item_count" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
CWE description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CVSS v3 base score: 6.5
Published: 2017-09-09T01:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/mov.c
Commit date: 2017-09-07 15:19:22 +0200
Commit message: avformat/mov: Fix DoS in read_tfra()

Fixes: Missing EOF check in loop
No testcase

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/mov.c b/libavformat/mov.c
index 994e9c6ebafc..251970734541 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -6092,10 +6092,17 @@ static int read_tfra(MOVContext *mov, AVIOContext *f)
         index->item_count = 0;
         return AVERROR(ENOMEM);
     }
     for (i = 0; i < index->item_count; i++) {
         int64_t time, offset;
+
+        if (avio_feof(f)) {
+            index->item_count = 0;
+            av_freep(&index->items);
+            return AVERROR_INVALIDDATA;
+        }
+
         if (version == 1) {
             time   = avio_rb64(f);
             offset = avio_rb64(f);
         } else {
             time   = avio_rb32(f);

Fixed code: 
        if (avio_feof(f)) {
            index->item_count = 0;
            av_freep(&index->items);
            return AVERROR_INVALIDDATA;
        }
CVE-2017-14223: Uncontrolled Resource Consumption (CWE-400)
value: In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 6.5
Published: 2017-09-09T01:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/asfdec_f.c
Commit date: 2017-09-07 15:19:22 +0200
Commit message: avformat/asfdec: Fix DoS in asf_build_simple_index()

Fixes: Missing EOF check in loop
No testcase

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
index f3acbae2801b..cc648b9a2f05 100644
--- a/libavformat/asfdec_f.c
+++ b/libavformat/asfdec_f.c
@@ -1608,10 +1608,15 @@ static int asf_build_simple_index(AVFormatContext *s, int stream_index)
             int pktnum        = avio_rl32(s->pb);
             int pktct         = avio_rl16(s->pb);
             int64_t pos       = s->internal->data_offset + s->packet_size * (int64_t)pktnum;
             int64_t index_pts = FFMAX(av_rescale(itime, i, 10000) - asf->hdr.preroll, 0);
 
+            if (avio_feof(s->pb)) {
+                ret = AVERROR_INVALIDDATA;
+                goto end;
+            }
+
             if (pos != last_pos) {
                 av_log(s, AV_LOG_DEBUG, "pktnum:%d, pktct:%d  pts: %"PRId64"\n",
                        pktnum, pktct, index_pts);
                 av_add_index_entry(s->streams[stream_index], pos, index_pts,
                                    s->packet_size, 0, AVINDEX_KEYFRAME);

Fixed code:             if (avio_feof(s->pb)) {
                ret = AVERROR_INVALIDDATA;
                goto end;
            }
CVE-2017-14767: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before 3.3.4 mishandles empty sprop-parameter-sets values, which allows remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 8.8
Published: 2017-09-27T08:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/rtpdec_h264.c
Commit date: 2017-08-23 22:19:33 +0200
Commit message: avformat/rtpdec_h264: Fix heap-buffer-overflow

Fixes: rtp_sdp/poc.sdp

Found-by: Bingchang <l.bing.chang.bc@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/rtpdec_h264.c b/libavformat/rtpdec_h264.c
index 8dd56a549e44..6f8148ab6d5d 100644
--- a/libavformat/rtpdec_h264.c
+++ b/libavformat/rtpdec_h264.c
@@ -164,11 +164,11 @@ static int sdp_parse_fmtp_config_h264(AVFormatContext *s,
     } else if (!strcmp(attr, "profile-level-id")) {
         if (strlen(value) == 6)
             parse_profile_level_id(s, h264_data, value);
     } else if (!strcmp(attr, "sprop-parameter-sets")) {
         int ret;
-        if (value[strlen(value) - 1] == ',') {
+        if (*value == 0 || value[strlen(value) - 1] == ',') {
             av_log(s, AV_LOG_WARNING, "Missing PPS in sprop-parameter-sets, ignoring\n");
             return 0;
         }
         par->extradata_size = 0;
         av_freep(&par->extradata);

Vulnerable code:         if (value[strlen(value) - 1] == ',') {
Fixed code:         if (*value == 0 || value[strlen(value) - 1] == ',') {
CVE-2017-17081: Out-of-bounds Read (CWE-125)
value: The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-11-30T21:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/x86/mpegvideodsp.c
Commit date: 2017-11-14 04:54:31 +0100
Commit message: avcodec/x86/mpegvideodsp: Fix signedness bug in need_emu

Fixes: out of array read
Fixes: 3516/attachment-311488.dat

Found-by: Insu Yun, Georgia Tech.
Tested-by: wuninsu@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavcodec/x86/mpegvideodsp.c b/libavcodec/x86/mpegvideodsp.c
index e0498f384962..6009b64e0769 100644
--- a/libavcodec/x86/mpegvideodsp.c
+++ b/libavcodec/x86/mpegvideodsp.c
@@ -50,12 +50,13 @@ static void gmc_mmx(uint8_t *dst, uint8_t *src,
 
     const int dxw = (dxx - (1 << (16 + shift))) * (w - 1);
     const int dyh = (dyy - (1 << (16 + shift))) * (h - 1);
     const int dxh = dxy * (h - 1);
     const int dyw = dyx * (w - 1);
-    int need_emu  =  (unsigned) ix >= width  - w ||
-                     (unsigned) iy >= height - h;
+    int need_emu  =  (unsigned) ix >= width  - w || width < w ||
+                     (unsigned) iy >= height - h || height< h
+                     ;
 
     if ( // non-constant fullpel offset (3% of blocks)
         ((ox ^ (ox + dxw)) | (ox ^ (ox + dxh)) | (ox ^ (ox + dxw + dxh)) |
          (oy ^ (oy + dyw)) | (oy ^ (oy + dyh)) | (oy ^ (oy + dyw + dyh))) >> (16 + shift) ||
         // uses more than 16 bits of subpel mv (only at huge resolution)

Vulnerable code:     int need_emu  =  (unsigned) ix >= width  - w ||
                     (unsigned) iy >= height - h;
Fixed code:     int need_emu  =  (unsigned) ix >= width  - w || width < w ||
                     (unsigned) iy >= height - h || height< h
                     ;
CVE-2017-7862: Out-of-bounds Write (CWE-787)
value: FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-04-14T04:59Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/pictordec.c
Commit date: 2017-02-07 21:32:08 +0100
Commit message: avcodec/pictordec: Fix logic error

Fixes: 559/clusterfuzz-testcase-6424225917173760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavcodec/pictordec.c b/libavcodec/pictordec.c
index ff6eb7f4fc94..0cfc78583265 100644
--- a/libavcodec/pictordec.c
+++ b/libavcodec/pictordec.c
@@ -140,11 +140,11 @@ static int decode_frame(AVCodecContext *avctx,
 
     avctx->pix_fmt = AV_PIX_FMT_PAL8;
 
     if (av_image_check_size(s->width, s->height, 0, avctx) < 0)
         return -1;
-    if (s->width != avctx->width && s->height != avctx->height) {
+    if (s->width != avctx->width || s->height != avctx->height) {
         ret = ff_set_dimensions(avctx, s->width, s->height);
         if (ret < 0)
             return ret;
     }
 

Vulnerable code:     if (s->width != avctx->width && s->height != avctx->height) {
Fixed code:     if (s->width != avctx->width || s->height != avctx->height) {