hitoshura25/cvefixes huggingface dataset:
CVE-2013-7020 (C, published 2013-12-09T16:36Z)
Description: value: The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not properly enforce certain bit-count and colorspace constraints, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/ffv1dec.c
Commit message: ffv1dec: Check bits_per_raw_sample and colorspace for equality in ver 0/1 headers

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
        int chroma_planes, chroma_h_shift, chroma_v_shift, transparency;
        f->colorspace = get_symbol(c, state, 0); //YUV cs type

        if (f->version > 0)
            f->avctx->bits_per_raw_sample = get_symbol(c, state, 0);

            if (   chroma_planes != f->chroma_planes

Fixed code:
        int chroma_planes, chroma_h_shift, chroma_v_shift, transparency, colorspace, bits_per_raw_sample;
        colorspace     = get_symbol(c, state, 0); //YUV cs type
        bits_per_raw_sample = f->version > 0 ? get_symbol(c, state, 0) : f->avctx->bits_per_raw_sample;
            if (   colorspace    != f->colorspace
                || bits_per_raw_sample != f->avctx->bits_per_raw_sample
                || chroma_planes != f->chroma_planes
        f->colorspace     = colorspace;
        f->avctx->bits_per_raw_sample = bits_per_raw_sample;
CVE-2013-7021 (C, published 2013-12-09T16:36Z)
Description: value: The filter_frame function in libavfilter/vf_fps.c in FFmpeg before 2.1 does not properly ensure the availability of FIFO content, which allows remote attackers to cause a denial of service (double free) or possibly have unspecified other impact via crafted data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavfilter/vf_fps.c
Commit message: avfilter/vf_fps: make sure the fifo is not empty before using it

Fixes Ticket2905

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
    if (buf->pts == AV_NOPTS_VALUE) {

Fixed code:
    if (buf->pts == AV_NOPTS_VALUE || av_fifo_size(s->fifo) <= 0) {
CVE-2013-7022 (C, published 2013-12-09T16:36Z)
Description: value: The g2m_init_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 does not properly allocate memory for tiles, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Go2Webinar data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/g2meet.c
Commit message: avcodec/g2meet: Fix framebuf size

Currently the code can in some cases draw tiles that hang outside the
allocated buffer. This patch increases the buffer size to avoid out
of array accesses. An alternative would be to fail if such tiles are
encountered.
I do not know if any valid files use such hanging tiles.

Fixes Ticket2971
Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
        c->framebuf_stride = FFALIGN(c->width * 3, 16);
        aligned_height     = FFALIGN(c->height,    16);

Fixed code:
        c->framebuf_stride = FFALIGN(c->width + 15, 16) * 3;
        aligned_height     = c->height + 15;
CVE-2013-7023 (C, published 2013-12-09T16:36Z)
Description: value: The ff_combine_frame function in libavcodec/parser.c in FFmpeg before 2.1 does not properly handle certain memory-allocation errors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/parser.c
Commit message: avcodec/parser: reset indexes on realloc failure

Fixes Ticket2982

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
        if(!new_buffer)

        if(!new_buffer)

Fixed code:
        if(!new_buffer) {
            pc->index = 0;
        }
        if(!new_buffer) {
            pc->overread_index =
            pc->index = 0;
        }
CVE-2013-7024 (C, published 2013-12-09T16:36Z)
Description: value: The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not consider the component number in certain calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/jpeg2000dec.c
Commit message: avcodec/jpeg2000dec: prevent out of array accesses in pixel addressing

Fixes Ticket2921

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
            line = picture->data[plane] + y * picture->linesize[plane];
                dst = line + x * pixelsize + compno*!planar;
            linel = (uint16_t *)picture->data[plane] + y * (picture->linesize[plane] >> 1);
                dst = linel + (x * pixelsize + compno*!planar);

Fixed code:
            line = picture->data[plane] + y / s->cdy[compno] * picture->linesize[plane];
                dst = line + x / s->cdx[compno] * pixelsize + compno*!planar;
            linel = (uint16_t *)picture->data[plane] + y / s->cdy[compno] * (picture->linesize[plane] >> 1);
                dst = linel + (x / s->cdx[compno] * pixelsize + compno*!planar);
CVE-2015-3417 (C, published 2015-04-24T17:59Z)
Description: value: Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/h264.c
Commit message: avcodec/h264: Clear delayed_pic on deallocation

Fixes use of freed memory

Fixes: case5_av_frame_copy_props.mp4
Found-by: Michal Zalewski <lcamtuf@coredump.cx>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:

Fixed code:
        memset(h->delayed_pic, 0, sizeof(h->delayed_pic));
CVE-2016-10191 (C, published 2017-02-09T15:59Z)
Description: value: Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/rtmppkt.c
Commit message: avformat/rtmppkt: Check for packet size mismatches

Fixes out of array access

Found-by: Paul Cher <paulcher@icloud.com>
Reviewed-by: Paul Cher <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:

Fixed code:
    if (prev_pkt[channel_id].read && size != prev_pkt[channel_id].size) {
        av_log(NULL, AV_LOG_ERROR, "RTMP packet size mismatch %d != %d\n",
                size,
                prev_pkt[channel_id].size);
        ff_rtmp_packet_destroy(&prev_pkt[channel_id]);
        prev_pkt[channel_id].read = 0;
    }
CVE-2016-10192 (C, published 2017-02-09T15:59Z)
Description: value: Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
ffserver.c
Commit message: ffserver: Check chunk size

Fixes out of array access

Fixes: poc_ffserver.py
Found-by: Paul Cher <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
            if (c->chunk_size == 0) // end of stream

Fixed code:
            if (c->chunk_size <= 0) { // end of stream or invalid chunk size
                c->chunk_size = 0;
            }
            av_assert0(len <= c->chunk_size);
CVE-2016-3062 (C, published 2016-06-16T18:59Z)
Description: value: The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/mov.c
Commit message: mov: reset dref_count on realloc to keep values consistent.

This fixes a potential crash.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:

Fixed code:
    sc->drefs_count = 0;
CVE-2017-11399 (C, published 2017-07-17T19:29Z)
Description: value: Integer overflow in the ape_decode_frame function in libavcodec/apedec.c in FFmpeg 2.4 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access and application crash) or possibly have unspecified other impact via a crafted APE file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/apedec.c
Commit message: avcodec/apedec: Fix integer overflow

Fixes: out of array access
Fixes: PoC.ape and others

Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
        if (!nblocks || nblocks > INT_MAX) {
    av_fast_malloc(&s->decoded_buffer, &s->decoded_size,
                   2 * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer));

Fixed code:
    uint64_t decoded_buffer_size;
        if (!nblocks || nblocks > INT_MAX / 2 / sizeof(*s->decoded_buffer) - 8) {
    decoded_buffer_size = 2LL * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer);
    av_assert0(decoded_buffer_size <= INT_MAX);
    av_fast_malloc(&s->decoded_buffer, &s->decoded_size, decoded_buffer_size);
CVE-2017-11719 (C, published 2017-07-28T05:29Z)
Description: value: The dnxhd_decode_header function in libavcodec/dnxhddec.c in FFmpeg 3.0 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a crafted DNxHD file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/dnxhddec.c
Commit message: avcodec/dnxhddec: Move mb height check out of non hr branch

Fixes: out of array access
Fixes: poc.dnxhd

Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
        if (ctx->mb_height > 68 ||
            (ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {

Fixed code:
        if (ctx->mb_height > 68) {
    if ((ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
        av_log(ctx->avctx, AV_LOG_ERROR,
                "mb height too big: %d\n", ctx->mb_height);
        return AVERROR_INVALIDDATA;
    }
CVE-2017-14054 (C, published 2017-08-31T15:29Z)
Description: value: In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted IVR file, which claims a large "len" field in the header but does not contain sufficient backing data, is provided, the first type==4 loop would consume huge CPU resources, since there is no EOF check inside the loop.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/rmdec.c
Commit message: avformat/rmdec: Fix DoS due to lack of eof check

Fixes: loop.ivr

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
            for (j = 0; j < len; j++)

Fixed code:
            for (j = 0; j < len; j++) {
                if (avio_feof(pb))
                    return AVERROR_INVALIDDATA;
            }
CVE-2017-14055 (C, published 2017-08-31T15:29Z)
Description: value: In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/mvdec.c
Commit message: avformat/mvdec: Fix DoS due to lack of eof check

Fixes: loop.mv

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:

Fixed code:
            if (avio_feof(pb))
                return AVERROR_INVALIDDATA;
CVE-2017-14056 (C, published 2017-08-31T15:29Z)
Description: value: In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large "frame_count" field in the header but does not contain sufficient backing data, is provided, the loops (for offset and size tables) would consume huge CPU and memory resources, since there is no EOF check inside these loops.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/rl2.c
Commit message: avformat/rl2: Fix DoS due to lack of eof check

Fixes: loop.rl2

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
    for(i=0; i < frame_count;i++)
    for(i=0; i < frame_count;i++)
    for(i=0; i < frame_count;i++)

Fixed code:
    for(i=0; i < frame_count;i++) {
        if (avio_feof(pb))
            return AVERROR_INVALIDDATA;
    }
    for(i=0; i < frame_count;i++) {
        if (avio_feof(pb))
            return AVERROR_INVALIDDATA;
    }
    for(i=0; i < frame_count;i++) {
        if (avio_feof(pb))
            return AVERROR_INVALIDDATA;
    }
CVE-2017-14057 (C, published 2017-08-31T15:29Z)
Description: value: In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "name_len" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/asfdec_f.c
Commit message: avformat/asfdec: Fix DoS due to lack of eof check

Fixes: loop.asf

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
    for (i = 0; i < name_len; i++)
        avio_r8(pb); // skip the name

Fixed code:
    avio_skip(pb, name_len);
        if (avio_feof(pb))
            return AVERROR_INVALIDDATA;
CVE-2017-14058 (C, published 2017-08-31T15:29Z)
Description: value: In FFmpeg 2.4 and 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allows remote attackers to cause a denial of service (infinite loop).
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
doc/demuxers.texi
libavformat/hls.c
Commit message: avformat/hls: Fix DoS due to infinite loop

Fixes: loop.m3u

The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome

Found-by: Xiaohei and Wangchu from Alibaba Security Team

Previous version reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:

Fixed code:
@section hls

HLS demuxer

It accepts the following options:

@table @option
@item live_start_index
segment index to start live streams at (negative values are from the end).

@item allowed_extensions
',' separated list of file extensions that hls is allowed to access.

@item max_reload
Maximum number of times a insufficient list is attempted to be reloaded.
Default value is 1000.
@end table

    int max_reload;
    int reload_count = 0;
        reload_count++;
        if (reload_count > c->max_reload)
            return AVERROR_EOF;
    {"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded",
        OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 1000}, 0, INT_MAX, FLAGS},
CVE-2017-14059 (C, published 2017-08-31T15:29Z)
Description: value: In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. When a crafted CINE file, which claims a large "duration" field in the header but does not contain sufficient backing data, is provided, the image-offset parsing loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/cinedec.c
Commit message: avformat/cinedec: Fix DoS due to lack of eof check

Fixes: loop.cine

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
    for (i = 0; i < st->duration; i++)

Fixed code:
    for (i = 0; i < st->duration; i++) {
        if (avio_feof(pb))
            return AVERROR_INVALIDDATA;

    }
CVE-2017-14169 (C, published 2017-09-07T06:29Z)
Description: value: In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, an integer signedness error might occur when a crafted file, which claims a large "item_num" field such as 0xffffffff, is provided. As a result, the variable "item_num" turns negative, bypassing the check for a large value.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/mxfdec.c
Commit message: avformat/mxfdec: Fix Sign error in mxf_read_primer_pack()

Fixes: 20170829B.mxf

Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com>
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
    if (item_num > 65536) {

Fixed code:
    if (item_num > 65536 || item_num < 0) {