[FFmpeg-devel] [PATCH] avformat/mov: Check that sample_sizes is allocated (PR #20250)

[Marvin Scholz]

PR #20250 opened by Marvin Scholz (ePirat)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20250
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20250.patch

The previous fix in 0ffe97d9b9e10e88db29d8d910c24ec00ef24edc only
checked the count, which is not sufficient. In case there is an invalid
(for example truncated) STSZ/STZ2 box, the previously allocated
sample_sizes array will be freed. If then another STSZ box is
encountered with a non-zero sample_size, the sample_count will be
written without a new sample_sizes array being allocated.

Fixes: NULL pointer dereference
Fixes: 437528618/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6537287645331456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


From 3ebb021ebd9703eaa6d1106eaebc2e358dcb3e32 Mon Sep 17 00:00:00 2001
From: Marvin Scholz <epirat07 at gmail.com>
Date: Fri, 15 Aug 2025 23:05:53 +0200
Subject: [PATCH] avformat/mov: Check that sample_sizes is allocated

The previous fix in 0ffe97d9b9e10e88db29d8d910c24ec00ef24edc only
checked the count, which is not sufficient. In case there is an invalid
(for example truncated) STSZ/STZ2 box, the previously allocated
sample_sizes array will be freed. If then another STSZ box is
encountered with a non-zero sample_size, the sample_count will be
written without a new sample_sizes array being allocated.

Fixes: NULL pointer dereference
Fixes: 437528618/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6537287645331456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
---
 libavformat/mov.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 86037c6712..d6fcb0c5dc 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -10472,7 +10472,7 @@ static int mov_parse_heif_items(AVFormatContext *s)
         st->codecpar->height = item->height;
 
         err = sanity_checks(s, sc, item->item_id);
-        if (err || !sc->sample_count)
+        if (err || !sc->sample_sizes)
             return AVERROR_INVALIDDATA;
 
         sc->sample_sizes[0]  = item->extent_length;
-- 
2.49.1