hitoshura25/cvefixes huggingface dataset:
CVE-2017-14170 (C, published 2017-09-07T06:29Z)
Description: value: In libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted MXF file, which claims a large "nb_index_entries" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU resources, since there is no EOF check inside the loop. Moreover, this big loop can be invoked multiple times if there is more than one applicable data segment in the crafted MXF file.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/mxfdec.c
Commit message: avformat/mxfdec: Fix DoS issues in mxf_read_index_entry_array()

Fixes: 20170829A.mxf

Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com>
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:

Fixed code:
    if(segment->nb_index_entries && length < 11)
        return AVERROR_INVALIDDATA;
        if(avio_feof(pb))
            return AVERROR_INVALIDDATA;
CVE-2017-14171 (C, published 2017-09-07T06:29Z)
Description: value: In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file, which claims a large "table_entries_used" field in the header but does not contain sufficient backing data, is provided, the loop over 'table_entries_used' would consume huge CPU resources, since there is no EOF check inside the loop.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/nsvdec.c
Commit message: avformat/nsvdec: Fix DoS due to lack of eof check in nsvs_file_offset loop.

Fixes: 20170829.nsv

Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com>
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
        for(i=0;i<table_entries_used;i++)

Fixed code:
        for(i=0;i<table_entries_used;i++) {
            if (avio_feof(pb))
                return AVERROR_INVALIDDATA;
        }
CVE-2017-14222 (C, published 2017-09-09T01:29Z)
Description: value: In libavformat/mov.c in FFmpeg 3.3.3, a DoS in read_tfra() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MOV file, which claims a large "item_count" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/mov.c
Commit message: avformat/mov: Fix DoS in read_tfra()

Fixes: Missing EOF check in loop
No testcase

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:

Fixed code:

        if (avio_feof(f)) {
            index->item_count = 0;
            av_freep(&index->items);
            return AVERROR_INVALIDDATA;
        }
CVE-2017-14223 (C, published 2017-09-09T01:29Z)
Description: value: In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/asfdec_f.c
Commit message: avformat/asfdec: Fix DoS in asf_build_simple_index()

Fixes: Missing EOF check in loop
No testcase

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:

Fixed code:
            if (avio_feof(s->pb)) {
                ret = AVERROR_INVALIDDATA;
                goto end;
            }
CVE-2017-14225 (C, published 2017-09-09T08:29Z)
Description: value: The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.)
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
ffprobe.c
Commit message: ffprobe: Fix null pointer dereference with color primaries

Found-by: AD-lab of venustech
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
        if (frame->color_primaries != AVCOL_PRI_UNSPECIFIED)
            print_str("color_primaries", av_color_primaries_name(frame->color_primaries));
        else
            print_str_opt("color_primaries", av_color_primaries_name(frame->color_primaries));
        if (par->color_primaries != AVCOL_PRI_UNSPECIFIED)
            print_str("color_primaries", av_color_primaries_name(par->color_primaries));
        else
            print_str_opt("color_primaries", av_color_primaries_name(par->color_primaries));

Fixed code:
static void print_primaries(WriterContext *w, enum AVColorPrimaries color_primaries)
{
    const char *val = av_color_primaries_name(color_primaries);
    if (!val || color_primaries == AVCOL_PRI_UNSPECIFIED) {
        print_str_opt("color_primaries", "unknown");
    } else {
        print_str("color_primaries", val);
    }
}

        print_primaries(w, frame->color_primaries);
        print_primaries(w, par->color_primaries);
CVE-2017-14767 (C, published 2017-09-27T08:29Z)
Description: value: The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before 3.3.4 mishandles empty sprop-parameter-sets values, which allows remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/rtpdec_h264.c
Commit message: avformat/rtpdec_h264: Fix heap-buffer-overflow

Fixes: rtp_sdp/poc.sdp

Found-by: Bingchang <l.bing.chang.bc@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
        if (value[strlen(value) - 1] == ',') {

Fixed code:
        if (*value == 0 || value[strlen(value) - 1] == ',') {
CVE-2017-17081 (C, published 2017-11-30T21:29Z)
Description: value: The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/x86/mpegvideodsp.c
Commit message: avcodec/x86/mpegvideodsp: Fix signedness bug in need_emu

Fixes: out of array read
Fixes: 3516/attachment-311488.dat

Found-by: Insu Yun, Georgia Tech.
Tested-by: wuninsu@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
    int need_emu  =  (unsigned) ix >= width  - w ||
                     (unsigned) iy >= height - h;

Fixed code:
    int need_emu  =  (unsigned) ix >= width  - w || width < w ||
                     (unsigned) iy >= height - h || height< h
                     ;
CVE-2017-7862 (C, published 2017-04-14T04:59Z)
Description: value: FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/pictordec.c
Commit message: avcodec/pictordec: Fix logic error

Fixes: 559/clusterfuzz-testcase-6424225917173760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
    if (s->width != avctx->width && s->height != avctx->height) {

Fixed code:
    if (s->width != avctx->width || s->height != avctx->height) {
CVE-2017-7863 (C, published 2017-04-14T04:59Z)
Description: value: FFmpeg before 2017-02-04 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in libavcodec/pngdec.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/pngdec.c
Commit message: avcodec/pngdec: Check trns more completely

Fixes out of array access
Fixes: 546/clusterfuzz-testcase-4809433909559296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
            (s->color_type == PNG_COLOR_TYPE_RGB && length != 6))

Fixed code:
    if (!(s->state & PNG_IHDR)) {
        av_log(avctx, AV_LOG_ERROR, "trns before IHDR\n");
        return AVERROR_INVALIDDATA;
    }

    if (s->state & PNG_IDAT) {
        av_log(avctx, AV_LOG_ERROR, "trns after IDAT\n");
        return AVERROR_INVALIDDATA;
    }

            (s->color_type == PNG_COLOR_TYPE_RGB && length != 6) ||
            s->bit_depth == 1)
        av_assert0(s->bit_depth > 1);
CVE-2017-7865 (C, published 2017-04-14T04:59Z)
Description: value: FFmpeg before 2017-01-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA function in libavcodec/interplayvideo.c and the avcodec_align_dimensions2 function in libavcodec/utils.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/utils.c
Commit message: avcodec/utils: correct align value for interplay

Fixes out of array access
Fixes: 452/fuzz-1-ffmpeg_VIDEO_AV_CODEC_ID_INTERPLAY_VIDEO_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
        if (s->codec_id == AV_CODEC_ID_JV) {

Fixed code:
        if (s->codec_id == AV_CODEC_ID_INTERPLAY_VIDEO) {
            w_align = 8;
            h_align = 8;
        }
        if (s->codec_id == AV_CODEC_ID_JV ||
            s->codec_id == AV_CODEC_ID_INTERPLAY_VIDEO) {
CVE-2017-7866 (C, published 2017-04-14T04:59Z)
Description: value: FFmpeg before 2017-01-23 has an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcodec/pngdec.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/pngdec.c
Commit message: avcodec/pngdec: Fix off by 1 size in decode_zbuf()

Fixes out of array access
Fixes: 444/fuzz-2-ffmpeg_VIDEO_AV_CODEC_ID_PNG_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
        av_bprint_get_buffer(bp, 1, &buf, &buf_size);
        if (!buf_size) {
        zstream.avail_out = buf_size;

Fixed code:
        av_bprint_get_buffer(bp, 2, &buf, &buf_size);
        if (buf_size < 2) {
        zstream.avail_out = buf_size - 1;
CVE-2017-9608 (C, published 2017-12-27T19:29Z)
Description: value: The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/dnxhd_parser.c
Commit message: avcodec/dnxhd_parser: Do not return invalid value from dnxhd_find_frame_end() on error

Fixes: Null pointer dereference

Fixes: CVE-2017-9608
Found-by: Yihan Lian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
                dctx->remaining = avpriv_dnxhd_get_frame_size(cid);
                if (dctx->remaining <= 0) {
                    dctx->remaining = ff_dnxhd_get_hr_frame_size(cid, dctx->w, dctx->h);
                    if (dctx->remaining <= 0)
                        return dctx->remaining;

Fixed code:
                int remaining;
                remaining = avpriv_dnxhd_get_frame_size(cid);
                if (remaining <= 0) {
                    remaining = ff_dnxhd_get_hr_frame_size(cid, dctx->w, dctx->h);
                    if (remaining <= 0)
                        continue;
                dctx->remaining = remaining;
CVE-2017-9990 (C, published 2017-06-28T06:29Z)
Description: value: Stack-based buffer overflow in the color_string_to_rgba function in libavcodec/xpmdec.c in FFmpeg 3.3 before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/xpmdec.c
Commit message: avcodec/xpmdec: Fix multiple pointer/memory issues

Most of these were found through code review in response to
fixing 1466/clusterfuzz-testcase-minimized-5961584419536896
There is thus no testcase for most of this.
The initial issue was Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
    const uint8_t *end, *ptr = avpkt->data;
    end = avpkt->data + avpkt->size;
    while (memcmp(ptr, "/* XPM */", 9) && ptr < end - 9)
    if (ptr >= end) {
        size *= 94;
        if (ptr + cpp > end)
            if (ptr + cpp > end)

Fixed code:
    uint8_t   *buf;
    int        buf_size;
    len = FFMIN(FFMAX(len, 0), sizeof(color_name) - 1);

    const uint8_t *end, *ptr;
    av_fast_padded_malloc(&x->buf, &x->buf_size, avpkt->size);
    if (!x->buf)
        return AVERROR(ENOMEM);
    memcpy(x->buf, avpkt->data, avpkt->size);
    x->buf[avpkt->size] = 0;

    ptr = x->buf;
    end = x->buf + avpkt->size;
    while (end - ptr > 9 && memcmp(ptr, "/* XPM */", 9))
    if (end - ptr <= 9) {
        size *= 95;
    if (end - ptr < 1)
        return AVERROR_INVALIDDATA;

        if (end - ptr < cpp)
        if (end - ptr < 1)
            return AVERROR_INVALIDDATA;
        if (end - ptr < 1)
            return AVERROR_INVALIDDATA;
        if (end - ptr < 1)
            return AVERROR_INVALIDDATA;
            if (end - ptr < cpp)
    av_freep(&x->buf);
    x->buf_size = 0;
CVE-2017-9991 (C, published 2017-06-28T06:29Z)
Description: value: Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/xwddec.c
Commit message: avcodec/xwddec: Check bpp more completely

Fixes out of array access
Fixes: 1399/clusterfuzz-testcase-minimized-4866094172995584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
        if (pixdepth == 1) {
        } else if (pixdepth == 8) {

Fixed code:
        if (bpp == 1 && pixdepth == 1) {
        } else if (bpp == 8 && pixdepth == 8) {
CVE-2017-9992 (C, published 2017-06-28T06:29Z)
Description: value: Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/dfa.c
Commit message: avcodec/dfa: Fix off by 1 error

Fixes out of array access
Fixes: 1345/clusterfuzz-testcase-minimized-6062963045695488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
            if (frame_end - frame < width + 3)

Fixed code:
            if (frame_end - frame < width + 4)
CVE-2017-9993 (C, published 2017-06-28T06:29Z)
Description: value: FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/avidec.c
Commit message: avformat/avidec: Limit formats in gab2 to srt and ass/ssa

This prevents part of one exploit leading to an information leak

Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:

Fixed code:
        if (strcmp(sub_demuxer->name, "srt") && strcmp(sub_demuxer->name, "ass"))
            goto error;
CVE-2017-9994 (C, published 2017-06-28T06:29Z)
Description: value: libavcodec/webp.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not ensure that pix_fmt is set, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file, related to the vp8_decode_mb_row_no_filter and pred8x8_128_dc_8_c functions.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/vp8.c
libavcodec/webp.c
Commit message: avcodec/webp: Always set pix_fmt

Fixes: out of array access
Fixes: 1434/clusterfuzz-testcase-minimized-6314998085189632
Fixes: 1435/clusterfuzz-testcase-minimized-6483783723253760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
        if (s->has_alpha)
            avctx->pix_fmt = AV_PIX_FMT_YUVA420P;

Fixed code:
    av_assert0(avctx->pix_fmt == AV_PIX_FMT_YUVA420P || avctx->pix_fmt == AV_PIX_FMT_YUV420P);

    avctx->pix_fmt = s->has_alpha ? AV_PIX_FMT_YUVA420P : AV_PIX_FMT_YUV420P;
CVE-2017-9995 (C, published 2017-06-28T06:29Z)
Description: value: libavcodec/scpr.c in FFmpeg 3.3 before 3.3.1 does not properly validate height and width data, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/scpr.c
Commit message: avcodec/scpr: Check y in first line loop in decompress_i()

Fixes: out of array access
Fixes: 1478/clusterfuzz-testcase-minimized-5285486908145664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:

Fixed code:
            if (y >= avctx->height)
                return AVERROR_INVALIDDATA;