Vulnerability: The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.)
Vulnerability ID: CVE-2017-14225
CWE: CWE-476
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2017-09-09
File: ffprobe.c
Commit message: ffprobe: Fix null pointer dereference with color primaries

Found-by: AD-lab of venustech
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static void print_pkt_side_data(WriterContext *w,     writer_print_section_footer(w); }  static void clear_log(int need_lock) {     int i; static void show_frame(WriterContext *w, AVFrame *frame, AVStream *stream,         else             print_str_opt("color_space", av_color_space_name(frame->colorspace));          if (frame->color_primaries != AVCOL_PRI_UNSPECIFIED)             print_str("color_primaries", av_color_primaries_name(frame->color_primaries));         else             print_str_opt("color_primaries", av_color_primaries_name(frame->color_primaries));          if (frame->color_trc != AVCOL_TRC_UNSPECIFIED)             print_str("color_transfer", av_color_transfer_name(frame->color_trc)); static int show_stream(WriterContext *w, AVFormatContext *fmt_ctx, int stream_id         else             print_str_opt("color_transfer", av_color_transfer_name(par->color_trc));          if (par->color_primaries != AVCOL_PRI_UNSPECIFIED)             print_str("color_primaries", av_color_primaries_name(par->color_primaries));         else             print_str_opt("color_primaries", av_color_primaries_name(par->color_primaries));          if (par->chroma_location != AVCHROMA_LOC_UNSPECIFIED)             print_str("chroma_location", av_chroma_location_name(par->chroma_location));

Fixed version (after fix):
 static void print_pkt_side_data(WriterContext *w,     writer_print_section_footer(w); }  static void print_primaries(WriterContext *w, enum AVColorPrimaries color_primaries) {     const char *val = av_color_primaries_name(color_primaries);     if (!val || color_primaries == AVCOL_PRI_UNSPECIFIED) {         print_str_opt("color_primaries", "unknown");     } else {         print_str("color_primaries", val);     } }  static void clear_log(int need_lock) {     int i; static void show_frame(WriterContext *w, AVFrame *frame, AVStream *stream,         else             print_str_opt("color_space", av_color_space_name(frame->colorspace));          print_primaries(w, frame->color_primaries);          if (frame->color_trc != AVCOL_TRC_UNSPECIFIED)             print_str("color_transfer", av_color_transfer_name(frame->color_trc)); static int show_stream(WriterContext *w, AVFormatContext *fmt_ctx, int stream_id         else             print_str_opt("color_transfer", av_color_transfer_name(par->color_trc));          print_primaries(w, par->color_primaries);          if (par->chroma_location != AVCHROMA_LOC_UNSPECIFIED)             print_str("chroma_location", av_chroma_location_name(par->chroma_location));

Patch:
patch: @@ -1925,6 +1925,16 @@ static void print_pkt_side_data(WriterContext *w,
     writer_print_section_footer(w);
 }
 
+static void print_primaries(WriterContext *w, enum AVColorPrimaries color_primaries)
+{
+    const char *val = av_color_primaries_name(color_primaries);
+    if (!val || color_primaries == AVCOL_PRI_UNSPECIFIED) {
+        print_str_opt("color_primaries", "unknown");
+    } else {
+        print_str("color_primaries", val);
+    }
+}
+
 static void clear_log(int need_lock)
 {
     int i;
@@ -2116,10 +2126,7 @@ static void show_frame(WriterContext *w, AVFrame *frame, AVStream *stream,
         else
             print_str_opt("color_space", av_color_space_name(frame->colorspace));
 
-        if (frame->color_primaries != AVCOL_PRI_UNSPECIFIED)
-            print_str("color_primaries", av_color_primaries_name(frame->color_primaries));
-        else
-            print_str_opt("color_primaries", av_color_primaries_name(frame->color_primaries));
+        print_primaries(w, frame->color_primaries);
 
         if (frame->color_trc != AVCOL_TRC_UNSPECIFIED)
             print_str("color_transfer", av_color_transfer_name(frame->color_trc));
@@ -2516,10 +2523,7 @@ static int show_stream(WriterContext *w, AVFormatContext *fmt_ctx, int stream_id
         else
             print_str_opt("color_transfer", av_color_transfer_name(par->color_trc));
 
-        if (par->color_primaries != AVCOL_PRI_UNSPECIFIED)
-            print_str("color_primaries", av_color_primaries_name(par->color_primaries));
-        else
-            print_str_opt("color_primaries", av_color_primaries_name(par->color_primaries));
+        print_primaries(w, par->color_primaries);
 
         if (par->chroma_location != AVCHROMA_LOC_UNSPECIFIED)
             print_str("chroma_location", av_chroma_location_name(par->chroma_location));
path: ffprobe.c