PR #21165 opened by ruikai
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21165
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21165.patch
In `libavformat/sierravmd.c (vmd_read_header)`, the header read check was
written as:
```
if ((ret = ffio_read_size(pb, vmd->vmd_header, VMD_HEADER_SIZE) < 0))
return ret;
```
Due to operator precedence, this stores the boolean result of the comparison
into ret, so a failed read (negative return) becomes `ret = 1,` which is
treated as success.
`avformat_open_input() `then completes with zero streams and uninitialized
state, letting the demuxer proceed into `vmd_read_packet()` with bogus tables.
We have not reported this as a security issue because we did not demonstrate a
ground-truth crash in validation, though it has an interesting possibility as
an OOB primitive.
Found-by: Pwno
>From d158e8605cdfcdbd973bddbed52fcc511e590a88 Mon Sep 17 00:00:00 2001
From: Ruikai Peng <[email protected]>
Date: Thu, 11 Dec 2025 06:27:48 +0000
Subject: [PATCH] VMD demuxer: precedence bug makes failed reads look like
success
---
libavformat/sierravmd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/sierravmd.c b/libavformat/sierravmd.c
index bb1d1c5df7..2519756533 100644
--- a/libavformat/sierravmd.c
+++ b/libavformat/sierravmd.c
@@ -103,7 +103,7 @@ static int vmd_read_header(AVFormatContext *s)
/* fetch the main header, including the 2 header length bytes */
avio_seek(pb, 0, SEEK_SET);
- if ((ret = ffio_read_size(pb, vmd->vmd_header, VMD_HEADER_SIZE) < 0))
+ if ((ret = ffio_read_size(pb, vmd->vmd_header, VMD_HEADER_SIZE)) < 0)
return ret;
width = AV_RL16(&vmd->vmd_header[12]);
--
2.49.1
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
