hitoshura25/cvefixes huggingface dataset:
CVE-2018-1999014 (C, published 2018-07-23T15:29Z)
Description: value: FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This attack appear to be exploitable via specially crafted MXF file which has to be provided as input. This vulnerability appears to have been fixed in bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 and later.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/mxfdec.c
Commit message: avformat/mxfdec: Fix av_log context

Fixes: out of array access
Fixes: mxf-crash-1c2e59bf07a34675bfb3ada5e1ec22fa9f38f923

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
                    av_log(mxf, AV_LOG_TRACE, "could not resolve essence container data strong ref\n");

Fixed code:
                    av_log(mxf->fc, AV_LOG_TRACE, "could not resolve essence container data strong ref\n");
CVE-2018-1999015 (C, published 2018-07-23T15:29Z)
Description: value: FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can result in heap memory reading. This attack appear to be exploitable via specially crafted ASF file that has to provided as input. This vulnerability appears to have been fixed in 5aba5b89d0b1d73164d3b81764828bb8b20ff32a and later.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/mpeg4videodec.c
Commit message: avcodec/mpeg4videodec: Check for bitstream end in read_quant_matrix_ext()

Fixes: out of array read
Fixes: asff-crash-0e53d0dc491dfdd507530b66562812fbd4c36678

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
static void read_quant_matrix_ext(MpegEncContext *s, GetBitContext *gb)

Fixed code:
static int read_quant_matrix_ext(MpegEncContext *s, GetBitContext *gb)
        if (get_bits_left(gb) < 64*8)
            return AVERROR_INVALIDDATA;
        if (get_bits_left(gb) < 64*8)
            return AVERROR_INVALIDDATA;
        if (get_bits_left(gb) < 64*8)
            return AVERROR_INVALIDDATA;
        if (get_bits_left(gb) < 64*8)
            return AVERROR_INVALIDDATA;
    return 0;
CVE-2019-11338 (C, published 2019-04-19T00:29Z)
Description: value: libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/hevcdec.c
Commit message: avcodec/hevcdec: Avoid only partly skiping duplicate first slices

Fixes: NULL pointer dereference and out of array access
Fixes: 13871/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5746167087890432
Fixes: 13845/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5650370728034304

This also fixes the return code for explode mode

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
            if (s->ref) {
                av_log(s->avctx, AV_LOG_ERROR, "Two slices reporting being the first in the same frame.\n");
                goto fail;
            }

Fixed code:
    if (s->ref && sh->first_slice_in_pic_flag) {
        av_log(s->avctx, AV_LOG_ERROR, "Two slices reporting being the first in the same frame.\n");
        return 1; // This slice will be skiped later, do not corrupt state
    }

        if (ret == 1) {
            ret = AVERROR_INVALIDDATA;
            goto fail;
        }
CVE-2019-11339 (C, published 2019-04-19T00:29Z)
Description: value: The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/mpeg4videodec.c
Commit message: avcodec/mpeg4videodec: Check idx in mpeg4_decode_studio_block()

Fixes: Out of array access
Fixes: 13500/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5769760178962432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Kieran Kunhya <kierank@obe.tv>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:

Fixed code:
            if (idx > 63)
                return AVERROR_INVALIDDATA;
            if (idx > 63)
                return AVERROR_INVALIDDATA;
            if (idx > 63)
                return AVERROR_INVALIDDATA;
CVE-2019-11339 (C, published 2019-04-19T00:29Z)
Description: value: The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/mpeg4videodec.c
Commit message: avcodec/mpeg4videodec: Clear interlaced_dct for studio profile

Fixes: Out of array access
Fixes: 13090/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5408668986638336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Kieran Kunhya <kierank@obe.tv>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:

Fixed code:
    s->interlaced_dct = 0;
CVE-2019-12730 (C, published 2019-06-04T14:29Z)
Description: value: aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/aadec.c
Commit message: avformat/aadec: Check for scanf() failure

Fixes: use of uninitialized variables
Fixes: blank.aa

Found-by: Chamal De Silva <chamal.desilva@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
            sscanf(val, "%"SCNu32"%"SCNu32"%"SCNu32"%"SCNu32,

Fixed code:
    int ret;

            ret = sscanf(val, "%"SCNu32"%"SCNu32"%"SCNu32"%"SCNu32,
            if (ret != 4)
                return AVERROR_INVALIDDATA;
CVE-2019-17539 (C, published 2019-10-14T02:15Z)
Description: value: In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/utils.c
Commit message: avcodec/utils: Check close before calling it

Fixes: NULL pointer dereference
Fixes: 15733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IDF_fuzzer-5658616977162240

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
    if (avctx->codec &&

Fixed code:
    if (avctx->codec && avctx->codec->close &&
CVE-2019-17542 (C, published 2019-10-14T02:15Z)
Description: value: FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/vqavideo.c
Commit message: avcodec/vqavideo: Set video size

Fixes: out of array access
Fixes: 15919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-5657368257363968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
    if ((ret = av_image_check_size(s->width, s->height, 0, avctx)) < 0) {

Fixed code:
    if ((ret = ff_set_dimensions(avctx, s->width, s->height)) < 0) {
CVE-2020-12284 (C, published 2020-04-28T06:15Z)
Description: value: cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/cbs_jpeg.c
Commit message: avcodec/cbs_jpeg: Check length for SOS

Fixes: out of array access
Fixes: 19734/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5673507031875584
Fixes: 19353/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5703944462663680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:

Fixed code:
            if (length > end - start)
                return AVERROR_INVALIDDATA;
CVE-2020-35964 (C, published 2021-01-03T19:15Z)
Description: value: track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/vividas.c
Commit message: avformat/vividas: improve extradata packing checks in track_header()

Fixes: out of array accesses
Fixes: 26622/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6581200338288640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
            int xd_size = 0;
                xd_size += len;
            ret = ff_alloc_extradata(st->codecpar, 64 + xd_size + xd_size / 255);
                if (delta > data_len[j]) {
                    return AVERROR_INVALIDDATA;
                }

Fixed code:
#include "libavutil/avassert.h"
            int xd_size = 1;
                xd_size += len + 1 + len/255;
            ret = ff_alloc_extradata(st->codecpar, xd_size);
                av_assert0(delta <= xd_size - offset);
                av_assert0(data_len[j] <= xd_size - offset);
CVE-2020-35965 (C, published 2021-01-04T02:15Z)
Description: value: decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/exr.c
Commit message: avcodec/exr: Check ymin vs. h

Fixes: out of array access
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344
Fixes: 27443/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5631239813595136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
        for (y = 0; y < s->ymin; y++) {

Fixed code:
        for (y = 0; y < FFMIN(s->ymin, s->h); y++) {
CVE-2020-35965 (C, published 2021-01-04T02:15Z)
Description: value: decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/exr.c
Commit message: avcodec/exr: skip bottom clearing loop when its outside the image

Fixes: signed integer overflow: 1633771809 * 32960 cannot be represented in type 'int'
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
    for (i = 0; i < planes; i++) {
        ptr = picture->data[i] + (ymax * picture->linesize[i]);
        for (y = ymax; y < avctx->height; y++) {
            memset(ptr, 0, out_line_size);
            ptr += picture->linesize[i];
    }

Fixed code:
    if (ymax < avctx->height)
        for (i = 0; i < planes; i++) {
            ptr = picture->data[i] + (ymax * picture->linesize[i]);
            for (y = ymax; y < avctx->height; y++) {
                memset(ptr, 0, out_line_size);
                ptr += picture->linesize[i];
            }
CVE-2020-36138 (C, published 2023-08-11T14:15Z)
Description: value: An issue was discovered in decode_frame in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service (DoS).
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/tiff.c
Commit message: avcodec/tiff: Disallow striped and tiled tiffs except for DNG

strips + tiles is not allowed in TIFF
DNG uses a separate codepath

Regression since da5b3d002862d1e105002a6dc1567e6551860896.

Fixes: NULL pointer dereference
Fixes: poc1
Fixes: Ticket8960

Found-by: 1vanChen of NSFOCUS Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
        av_log(avctx, AV_LOG_WARNING, "Tiled TIFF is not allowed to strip\n");
    if (!s->is_tiled) {

Fixed code:
        int tiled_dng = s->is_tiled && is_dng;
        av_log(avctx, tiled_dng ? AV_LOG_WARNING : AV_LOG_ERROR, "Tiled TIFF is not allowed to strip\n");
        if (!tiled_dng)
            return AVERROR_INVALIDDATA;
    if (!s->is_tiled || has_strip_bits) {
CVE-2021-33815 (C, published 2021-06-03T17:15Z)
Description: value: dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly checked.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-129 \u2014 Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/exr.c
Commit message: avcodec/exr: More strictly check dc_count

Fixes: out of array access
Fixes: exr/deneme

Found-by: Burak Çarıkçı <burakcarikci@crypttech.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
    if (dc_size > 0) {
        if (dc_count > (6LL * td->xsize * td->ysize + 63) / 64)

Fixed code:
    {
        if (dc_count != dc_w * dc_h * 3)
CVE-2021-3566 (C, published 2021-08-05T21:15Z)
Description: value: Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/tty.c
Commit message: avformat/tty: add probe function


Vulnerable code:
    .extensions     = "ans,art,asc,diz,ice,nfo,txt,vt",

Fixed code:
static int isansicode(int x)
{
    return x == 0x1B || x == 0x0A || x == 0x0D || (x >= 0x20 && x < 0x7f);
}

static const char tty_extensions[31] = "ans,art,asc,diz,ice,nfo,txt,vt";

static int read_probe(const AVProbeData *p)
{
    int cnt = 0;

    for (int i = 0; i < p->buf_size; i++)
        cnt += !!isansicode(p->buf[i]);

    return (cnt * 100LL / p->buf_size) * (cnt > 400) *
        !!av_match_ext(p->filename, tty_extensions);
}

    .read_probe     = read_probe,
    .extensions     = tty_extensions,
CVE-2021-38114 (C, published 2021-08-04T21:15Z)
Description: value: libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-252 \u2014 Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/dnxhddec.c
Commit message: avcodec/dnxhddec: check and propagate function return value

Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed.
crafted DNxHD data can cause unspecified impact.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>


Vulnerable code:
        init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
                 ctx->cid_table->ac_codes, 2, 2, 0);
        init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
                 ctx->cid_table->dc_codes, 1, 1, 0);
        init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
                 ctx->cid_table->run_codes, 2, 2, 0);
    return 0;

Fixed code:
    int ret;
        if ((ret = init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
                 ctx->cid_table->ac_codes, 2, 2, 0)) < 0)
            goto out;
        if ((ret = init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
                 ctx->cid_table->dc_codes, 1, 1, 0)) < 0)
            goto out;
        if ((ret = init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
                 ctx->cid_table->run_codes, 2, 2, 0)) < 0)
            goto out;
    ret = 0;
out:
    if (ret < 0)
        av_log(ctx->avctx, AV_LOG_ERROR, "init_vlc failed\n");
    return ret;
CVE-2021-38171 (C, published 2021-08-21T17:15Z)
Description: value: adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argument to init_get_bits can be crafted.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-252 \u2014 Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/adtsenc.c
Commit message: avformat/adtsenc: return value check for init_get_bits in adts_decode_extradata

As the second argument for init_get_bits (buf) can be crafted, a return value check for this function call is necessary.
'buf' is  part of  'AVPacket pkt'.
replace init_get_bits with init_get_bits8.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
    int off;
    init_get_bits(&gb, buf, size * 8);

Fixed code:
    int off, ret;
    ret = init_get_bits8(&gb, buf, size);
    if (ret < 0)
        return ret;
CVE-2022-2566 (C, published 2022-09-23T12:15Z)
Description: value: A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loop and adds `sc->ctts_data[i].count` to `sc->sample_offsets_count`. This can lead to an integer overflow resulting in a small allocation with `av_calloc()`. An attacker can cause remote code execution via a malicious mp4 file. We recommend upgrading past commit c953baa084607dd1d84c3bfcce3cf6a87c3e6e05
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/mov.c
Commit message: avformat/mov: Check count sums in build_open_gop_key_points()

Fixes: ffmpeg.md
Fixes: Out of array access
Fixes: CVE-2022-2566

Found-by: Andy Nguyen <theflow@google.com>
Found-by: 3pvd <3pvd@google.com>
Reviewed-by: Andy Nguyen <theflow@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
    for (uint32_t i = 0; i < sc->ctts_count; i++)
        if (sc->sync_group[i].index == cra_index)

Fixed code:
    for (uint32_t i = 0; i < sc->ctts_count; i++) {
        if (sc->ctts_data[i].count > INT_MAX - sc->sample_offsets_count)
            return AVERROR(ENOMEM);
    }
        if (sc->sync_group[i].index == cra_index) {
            if (sc->sync_group[i].count > INT_MAX - sc->open_key_samples_count)
                return AVERROR(ENOMEM);
        }
        if (sg->count > INT_MAX - sample_id)
            return AVERROR_PATCHWELCOME;
CVE-2022-3109 (C, published 2022-12-16T15:15Z)
Description: value: An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting availability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/vp3.c
Commit message: avcodec/vp3: Add missing check for av_malloc

Since the av_malloc() may fail and return NULL pointer,
it is needed that the 's->edge_emu_buffer' should be checked
whether the new allocation is success.

Fixes: d14723861b ("VP3: fix decoding of videos with stride > 2048")
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>


Vulnerable code:
    if (!s->edge_emu_buffer)

Fixed code:
    if (!s->edge_emu_buffer) {
        if (!s->edge_emu_buffer) {
            ret = AVERROR(ENOMEM);
            goto error;
        }
    }