CVE-2023-50007: Insufficient Information (NVD-CWE-noinfo)
value: Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via theav_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-19T17:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavfilter/af_afwtdn.c
Commit date: 2023-11-27 11:56:26 +0100
Commit message: avfilter/af_afwtdn: fix crash with EOF handling

Diff: diff --git a/libavfilter/af_afwtdn.c b/libavfilter/af_afwtdn.c
index 0fcfa779f9194..63b7f5fc25909 100644
--- a/libavfilter/af_afwtdn.c
+++ b/libavfilter/af_afwtdn.c
@@ -406,10 +406,11 @@ typedef struct AudioFWTDNContext {
     double percent;
     double softness;
 
     uint64_t sn;
     int64_t eof_pts;
+    int eof;
 
     int wavelet_type;
     int channels;
     int nb_samples;
     int levels;
@@ -1067,11 +1068,11 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
         out->pts = in->pts - av_rescale_q(s->delay, (AVRational){1, outlink->sample_rate}, outlink->time_base);
         s->delay += s->drop_samples;
         s->drop_samples = 0;
     } else {
         if (s->padd_samples < 0 && eof) {
-            out->nb_samples += s->padd_samples;
+            out->nb_samples = FFMAX(0, out->nb_samples + s->padd_samples);
             s->padd_samples = 0;
         }
         if (!eof)
             out->pts = in->pts - av_rescale_q(s->delay, (AVRational){1, outlink->sample_rate}, outlink->time_base);
     }
@@ -1206,27 +1207,30 @@ static int activate(AVFilterContext *ctx)
     int ret, status;
     int64_t pts;
 
     FF_FILTER_FORWARD_STATUS_BACK(outlink, inlink);
 
-    ret = ff_inlink_consume_samples(inlink, s->nb_samples, s->nb_samples, &in);
-    if (ret < 0)
-        return ret;
-    if (ret > 0)
-        return filter_frame(inlink, in);
+    if (!s->eof) {
+        ret = ff_inlink_consume_samples(inlink, s->nb_samples, s->nb_samples, &in);
+        if (ret < 0)
+            return ret;
+        if (ret > 0)
+            return filter_frame(inlink, in);
+    }
 
     if (ff_inlink_acknowledge_status(inlink, &status, &pts)) {
-        if (status == AVERROR_EOF) {
-            while (s->padd_samples != 0) {
-                ret = filter_frame(inlink, NULL);
-                if (ret < 0)
-                    return ret;
-            }
-            ff_outlink_set_status(outlink, status, pts);
-            return ret;
-        }
+        if (status == AVERROR_EOF)
+            s->eof = 1;
     }
+
+    if (s->eof && s->padd_samples != 0) {
+        return filter_frame(inlink, NULL);
+    } else if (s->eof) {
+        ff_outlink_set_status(outlink, AVERROR_EOF, s->eof_pts);
+        return 0;
+    }
+
     FF_FILTER_FORWARD_WANTED(outlink, inlink);
 
     return FFERROR_NOT_READY;
 }
 

Vulnerable code:             out->nb_samples += s->padd_samples;
    ret = ff_inlink_consume_samples(inlink, s->nb_samples, s->nb_samples, &in);
    if (ret < 0)
        return ret;
    if (ret > 0)
        return filter_frame(inlink, in);
        if (status == AVERROR_EOF) {
            while (s->padd_samples != 0) {
                ret = filter_frame(inlink, NULL);
                if (ret < 0)
                    return ret;
            }
            ff_outlink_set_status(outlink, status, pts);
            return ret;
        }
Fixed code:     int eof;
            out->nb_samples = FFMAX(0, out->nb_samples + s->padd_samples);
    if (!s->eof) {
        ret = ff_inlink_consume_samples(inlink, s->nb_samples, s->nb_samples, &in);
        if (ret < 0)
            return ret;
        if (ret > 0)
            return filter_frame(inlink, in);
    }
        if (status == AVERROR_EOF)
            s->eof = 1;

    if (s->eof && s->padd_samples != 0) {
        return filter_frame(inlink, NULL);
    } else if (s->eof) {
        ff_outlink_set_status(outlink, AVERROR_EOF, s->eof_pts);
        return 0;
    }