CVE-2017-14225 (published 2017-09-09T08:29Z)

The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.)

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: Michael Niedermayer
author_date: 2017-08-22 11:02:38+02:00
msg: ffprobe: Fix null pointer dereference with color primaries

Found-by: AD-lab of venustech
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: ffprobe.c
change_type: ModificationType.MODIFY
diff: @@ -1925,6 +1925,16 @@ static void print_pkt_side_data(WriterContext *w,
     writer_print_section_footer(w);
 }
 
+static void print_primaries(WriterContext *w, enum AVColorPrimaries color_primaries)
+{
+    const char *val = av_color_primaries_name(color_primaries);
+    if (!val || color_primaries == AVCOL_PRI_UNSPECIFIED) {
+        print_str_opt("color_primaries", "unknown");
+    } else {
+        print_str("color_primaries", val);
+    }
+}
+
 static void clear_log(int need_lock)
 {
     int i;
@@ -2116,10 +2126,7 @@ static void show_frame(WriterContext *w, AVFrame *frame, AVStream *stream,
         else
             print_str_opt("color_space", av_color_space_name(frame->colorspace));
 
-        if (frame->color_primaries != AVCOL_PRI_UNSPECIFIED)
-            print_str("color_primaries", av_color_primaries_name(frame->color_primaries));
-        else
-            print_str_opt("color_primaries", av_color_primaries_name(frame->color_primaries));
+        print_primaries(w, frame->color_primaries);
 
         if (frame->color_trc != AVCOL_TRC_UNSPECIFIED)
             print_str("color_transfer", av_color_transfer_name(frame->color_trc));
@@ -2516,10 +2523,7 @@ static int show_stream(WriterContext *w, AVFormatContext *fmt_ctx, int stream_id
         else
             print_str_opt("color_transfer", av_color_transfer_name(par->color_trc));
 
-        if (par->color_primaries != AVCOL_PRI_UNSPECIFIED)
-            print_str("color_primaries", av_color_primaries_name(par->color_primaries));
-        else
-            print_str_opt("color_primaries", av_color_primaries_name(par->color_primaries));
+        print_primaries(w, par->color_primaries);
 
         if (par->chroma_location != AVCHROMA_LOC_UNSPECIFIED)
             print_str("chroma_location", av_chroma_location_name(par->chroma_location));

programming_language: C