Vulnerability: The ff_combine_frame function in libavcodec/parser.c in FFmpeg before 2.1 does not properly handle certain memory-allocation errors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data.
Vulnerability ID: CVE-2013-7023
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2013-12-09
File: libavcodec/parser.c
Commit message: avcodec/parser: reset indexes on realloc failure

Fixes Ticket2982

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s     if(next == END_NOT_FOUND){         void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, (*buf_size) + pc->index + FF_INPUT_BUFFER_PADDING_SIZE);          if(!new_buffer)             return AVERROR(ENOMEM);         pc->buffer = new_buffer;         memcpy(&pc->buffer[pc->index], *buf, *buf_size);         pc->index += *buf_size; int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s     /* append to buffer */     if(pc->index){         void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, next + pc->index + FF_INPUT_BUFFER_PADDING_SIZE);          if(!new_buffer)             return AVERROR(ENOMEM);         pc->buffer = new_buffer;         if (next > -FF_INPUT_BUFFER_PADDING_SIZE)             memcpy(&pc->buffer[pc->index], *buf,

Fixed version (after fix):
 int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s     if(next == END_NOT_FOUND){         void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, (*buf_size) + pc->index + FF_INPUT_BUFFER_PADDING_SIZE);          if(!new_buffer) {             pc->index = 0;             return AVERROR(ENOMEM);         }         pc->buffer = new_buffer;         memcpy(&pc->buffer[pc->index], *buf, *buf_size);         pc->index += *buf_size; int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s     /* append to buffer */     if(pc->index){         void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, next + pc->index + FF_INPUT_BUFFER_PADDING_SIZE);         if(!new_buffer) {             pc->overread_index =             pc->index = 0;             return AVERROR(ENOMEM);         }         pc->buffer = new_buffer;         if (next > -FF_INPUT_BUFFER_PADDING_SIZE)             memcpy(&pc->buffer[pc->index], *buf,

Patch:
patch: @@ -237,8 +237,10 @@ int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s
     if(next == END_NOT_FOUND){
         void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, (*buf_size) + pc->index + FF_INPUT_BUFFER_PADDING_SIZE);
 
-        if(!new_buffer)
+        if(!new_buffer) {
+            pc->index = 0;
             return AVERROR(ENOMEM);
+        }
         pc->buffer = new_buffer;
         memcpy(&pc->buffer[pc->index], *buf, *buf_size);
         pc->index += *buf_size;
@@ -251,9 +253,11 @@ int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s
     /* append to buffer */
     if(pc->index){
         void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, next + pc->index + FF_INPUT_BUFFER_PADDING_SIZE);
-
-        if(!new_buffer)
+        if(!new_buffer) {
+            pc->overread_index =
+            pc->index = 0;
             return AVERROR(ENOMEM);
+        }
         pc->buffer = new_buffer;
         if (next > -FF_INPUT_BUFFER_PADDING_SIZE)
             memcpy(&pc->buffer[pc->index], *buf,
path: libavcodec/parser.c