CVE-2023-47470 (published 2023-11-16T03:15Z)

Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary code, and cause a denial of service (DoS) via the ref_pic_list_struct function in libavcodec/evc_ps.c

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: Michael Niedermayer
author_date: 2023-08-01 00:56:34+02:00
msg: avcodec/evc_ps: Check ref_pic_num and sps_max_dec_pic_buffering_minus1

Fixes: out of array write

Found-by: dongsookim@korea.ac.kr
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: evc_ps.c
change_type: ModificationType.MODIFY
diff: @@ -24,10 +24,14 @@
 #define EXTENDED_SAR 255
 
 // @see ISO_IEC_23094-1 (7.3.7 Reference picture list structure syntax)
-static int ref_pic_list_struct(GetBitContext *gb, RefPicListStruct *rpl)
+static int ref_pic_list_struct(EVCParserSPS *sps, GetBitContext *gb, RefPicListStruct *rpl)
 {
     uint32_t delta_poc_st, strp_entry_sign_flag = 0;
     rpl->ref_pic_num = get_ue_golomb_long(gb);
+
+    if ((unsigned)rpl->ref_pic_num  > sps->sps_max_dec_pic_buffering_minus1)
+        return AVERROR_INVALIDDATA;
+
     if (rpl->ref_pic_num > 0) {
         delta_poc_st = get_ue_golomb_long(gb);
 
@@ -239,6 +243,8 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
         sps->max_num_tid0_ref_pics = get_ue_golomb_31(gb);
     else {
         sps->sps_max_dec_pic_buffering_minus1 = get_ue_golomb_long(gb);
+        if ((unsigned)sps->sps_max_dec_pic_buffering_minus1 > 16 - 1)
+            return AVERROR_INVALIDDATA;
         sps->long_term_ref_pic_flag = get_bits1(gb);
         sps->rpl1_same_as_rpl0_flag = get_bits1(gb);
         sps->num_ref_pic_list_in_sps[0] = get_ue_golomb(gb);
@@ -248,8 +254,11 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
             goto fail;
         }
 
-        for (int i = 0; i < sps->num_ref_pic_list_in_sps[0]; ++i)
-            ref_pic_list_struct(gb, &sps->rpls[0][i]);
+        for (int i = 0; i < sps->num_ref_pic_list_in_sps[0]; ++i) {
+            ret = ref_pic_list_struct(sps, gb, &sps->rpls[0][i]);
+            if (ret < 0)
+                goto fail;
+        }
 
         if (!sps->rpl1_same_as_rpl0_flag) {
             sps->num_ref_pic_list_in_sps[1] = get_ue_golomb(gb);
@@ -257,8 +266,11 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
                 ret = AVERROR_INVALIDDATA;
                 goto fail;
             }
-            for (int i = 0; i < sps->num_ref_pic_list_in_sps[1]; ++i)
-                ref_pic_list_struct(gb, &sps->rpls[1][i]);
+            for (int i = 0; i < sps->num_ref_pic_list_in_sps[1]; ++i) {
+                ret = ref_pic_list_struct(sps, gb, &sps->rpls[1][i]);
+                if (ret < 0)
+                    goto fail;
+            }
         }
     }
 

programming_language: C