CVE-2017-14225: NULL Pointer Dereference (CWE-476)
value: The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.)
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 8.8
Published: 2017-09-09T08:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: ffprobe.c
Commit date: 2017-08-24 11:31:03 +0200
Commit message: ffprobe: Fix null pointer dereference with color primaries

Found-by: AD-lab of venustech
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/ffprobe.c b/ffprobe.c
index 50d7c1a777c9..d4bdd9c09938 100644
--- a/ffprobe.c
+++ b/ffprobe.c
@@ -1923,10 +1923,20 @@ static void print_pkt_side_data(WriterContext *w,
         writer_print_section_footer(w);
     }
     writer_print_section_footer(w);
 }
 
+static void print_primaries(WriterContext *w, enum AVColorPrimaries color_primaries)
+{
+    const char *val = av_color_primaries_name(color_primaries);
+    if (!val || color_primaries == AVCOL_PRI_UNSPECIFIED) {
+        print_str_opt("color_primaries", "unknown");
+    } else {
+        print_str("color_primaries", val);
+    }
+}
+
 static void clear_log(int need_lock)
 {
     int i;
 
     if (need_lock)
@@ -2114,14 +2124,11 @@ static void show_frame(WriterContext *w, AVFrame *frame, AVStream *stream,
         if (frame->colorspace != AVCOL_SPC_UNSPECIFIED)
             print_str("color_space", av_color_space_name(frame->colorspace));
         else
             print_str_opt("color_space", av_color_space_name(frame->colorspace));
 
-        if (frame->color_primaries != AVCOL_PRI_UNSPECIFIED)
-            print_str("color_primaries", av_color_primaries_name(frame->color_primaries));
-        else
-            print_str_opt("color_primaries", av_color_primaries_name(frame->color_primaries));
+        print_primaries(w, frame->color_primaries);
 
         if (frame->color_trc != AVCOL_TRC_UNSPECIFIED)
             print_str("color_transfer", av_color_transfer_name(frame->color_trc));
         else
             print_str_opt("color_transfer", av_color_transfer_name(frame->color_trc));
@@ -2514,14 +2521,11 @@ static int show_stream(WriterContext *w, AVFormatContext *fmt_ctx, int stream_id
         if (par->color_trc != AVCOL_TRC_UNSPECIFIED)
             print_str("color_transfer", av_color_transfer_name(par->color_trc));
         else
             print_str_opt("color_transfer", av_color_transfer_name(par->color_trc));
 
-        if (par->color_primaries != AVCOL_PRI_UNSPECIFIED)
-            print_str("color_primaries", av_color_primaries_name(par->color_primaries));
-        else
-            print_str_opt("color_primaries", av_color_primaries_name(par->color_primaries));
+        print_primaries(w, par->color_primaries);
 
         if (par->chroma_location != AVCHROMA_LOC_UNSPECIFIED)
             print_str("chroma_location", av_chroma_location_name(par->chroma_location));
         else
             print_str_opt("chroma_location", av_chroma_location_name(par->chroma_location));

Vulnerable code:         if (frame->color_primaries != AVCOL_PRI_UNSPECIFIED)
            print_str("color_primaries", av_color_primaries_name(frame->color_primaries));
        else
            print_str_opt("color_primaries", av_color_primaries_name(frame->color_primaries));
        if (par->color_primaries != AVCOL_PRI_UNSPECIFIED)
            print_str("color_primaries", av_color_primaries_name(par->color_primaries));
        else
            print_str_opt("color_primaries", av_color_primaries_name(par->color_primaries));
Fixed code: static void print_primaries(WriterContext *w, enum AVColorPrimaries color_primaries)
{
    const char *val = av_color_primaries_name(color_primaries);
    if (!val || color_primaries == AVCOL_PRI_UNSPECIFIED) {
        print_str_opt("color_primaries", "unknown");
    } else {
        print_str("color_primaries", val);
    }
}

        print_primaries(w, frame->color_primaries);
        print_primaries(w, par->color_primaries);