Vulnerability: The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not properly enforce certain bit-count and colorspace constraints, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data.
Vulnerability ID: CVE-2013-7020
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2013-12-09
File: libavcodec/ffv1dec.c
Commit message: ffv1dec: Check bits_per_raw_sample and colorspace for equality in ver 0/1 headers

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int read_header(FFV1Context *f)     memset(state, 128, sizeof(state));      if (f->version < 2) {         int chroma_planes, chroma_h_shift, chroma_v_shift, transparency;         unsigned v= get_symbol(c, state, 0);         if (v >= 2) {             av_log(f->avctx, AV_LOG_ERROR, "invalid version %d in ver01 header\n", v); static int read_header(FFV1Context *f)                 f->state_transition[i] = get_symbol(c, state, 1) + c->one_state[i];         }          f->colorspace = get_symbol(c, state, 0); //YUV cs type          if (f->version > 0)             f->avctx->bits_per_raw_sample = get_symbol(c, state, 0);          chroma_planes  = get_rac(c, state);         chroma_h_shift = get_symbol(c, state, 0);         chroma_v_shift = get_symbol(c, state, 0);         transparency   = get_rac(c, state);          if (f->plane_count) {             if (   chroma_planes != f->chroma_planes                 || chroma_h_shift!= f->chroma_h_shift                 || chroma_v_shift!= f->chroma_v_shift                 || transparency  != f->transparency) { static int read_header(FFV1Context *f)             }         }          f->chroma_planes  = chroma_planes;         f->chroma_h_shift = chroma_h_shift;         f->chroma_v_shift = chroma_v_shift;

Fixed version (after fix):
 static int read_header(FFV1Context *f)     memset(state, 128, sizeof(state));      if (f->version < 2) {         int chroma_planes, chroma_h_shift, chroma_v_shift, transparency, colorspace, bits_per_raw_sample;         unsigned v= get_symbol(c, state, 0);         if (v >= 2) {             av_log(f->avctx, AV_LOG_ERROR, "invalid version %d in ver01 header\n", v); static int read_header(FFV1Context *f)                 f->state_transition[i] = get_symbol(c, state, 1) + c->one_state[i];         }          colorspace     = get_symbol(c, state, 0); //YUV cs type         bits_per_raw_sample = f->version > 0 ? get_symbol(c, state, 0) : f->avctx->bits_per_raw_sample;         chroma_planes  = get_rac(c, state);         chroma_h_shift = get_symbol(c, state, 0);         chroma_v_shift = get_symbol(c, state, 0);         transparency   = get_rac(c, state);          if (f->plane_count) {             if (   colorspace    != f->colorspace                 || bits_per_raw_sample != f->avctx->bits_per_raw_sample                 || chroma_planes != f->chroma_planes                 || chroma_h_shift!= f->chroma_h_shift                 || chroma_v_shift!= f->chroma_v_shift                 || transparency  != f->transparency) { static int read_header(FFV1Context *f)             }         }          f->colorspace     = colorspace;         f->avctx->bits_per_raw_sample = bits_per_raw_sample;         f->chroma_planes  = chroma_planes;         f->chroma_h_shift = chroma_h_shift;         f->chroma_v_shift = chroma_v_shift;

Patch:
patch: @@ -580,7 +580,7 @@ static int read_header(FFV1Context *f)
     memset(state, 128, sizeof(state));
 
     if (f->version < 2) {
-        int chroma_planes, chroma_h_shift, chroma_v_shift, transparency;
+        int chroma_planes, chroma_h_shift, chroma_v_shift, transparency, colorspace, bits_per_raw_sample;
         unsigned v= get_symbol(c, state, 0);
         if (v >= 2) {
             av_log(f->avctx, AV_LOG_ERROR, "invalid version %d in ver01 header\n", v);
@@ -593,18 +593,17 @@ static int read_header(FFV1Context *f)
                 f->state_transition[i] = get_symbol(c, state, 1) + c->one_state[i];
         }
 
-        f->colorspace = get_symbol(c, state, 0); //YUV cs type
-
-        if (f->version > 0)
-            f->avctx->bits_per_raw_sample = get_symbol(c, state, 0);
-
+        colorspace     = get_symbol(c, state, 0); //YUV cs type
+        bits_per_raw_sample = f->version > 0 ? get_symbol(c, state, 0) : f->avctx->bits_per_raw_sample;
         chroma_planes  = get_rac(c, state);
         chroma_h_shift = get_symbol(c, state, 0);
         chroma_v_shift = get_symbol(c, state, 0);
         transparency   = get_rac(c, state);
 
         if (f->plane_count) {
-            if (   chroma_planes != f->chroma_planes
+            if (   colorspace    != f->colorspace
+                || bits_per_raw_sample != f->avctx->bits_per_raw_sample
+                || chroma_planes != f->chroma_planes
                 || chroma_h_shift!= f->chroma_h_shift
                 || chroma_v_shift!= f->chroma_v_shift
                 || transparency  != f->transparency) {
@@ -613,6 +612,8 @@ static int read_header(FFV1Context *f)
             }
         }
 
+        f->colorspace     = colorspace;
+        f->avctx->bits_per_raw_sample = bits_per_raw_sample;
         f->chroma_planes  = chroma_planes;
         f->chroma_h_shift = chroma_h_shift;
         f->chroma_v_shift = chroma_v_shift;
path: libavcodec/ffv1dec.c