Adrian Junge

The Go2Meeting decoder contains an issue where an uninitialized variable is used, allowing attackers to leak stack memory via out-of-range palette indices. By crafting a G2M3/G2M4 stream with a short Kempf palette, the `kempf restore buf()` function may copy uninitialized stack bytes, such as pointers or stack guards, into the decoded output.

The PCX decoder contains a use of uninitialized resource issue. An attacker can craft a PCX image with RLE (Run-Length Encoding, a form of lossless data compression) data that ends prematurely. This causes the `pcx decode frame()` function to copy uninitialized `av malloc()` buffer contents into visible decoded pixels, leading to a heap memory leak.

A use of uninitialized resource issue exists in the `sunrast decode frame()` function. This occurs when decoding truncated 1-bit and 4-bit paletted Sun Raster images, leading to heap memory leaks. An attacker can provide a specially crafted truncated Sun Raster file that causes an uncleared temporary bitmap to be expanded into PAL8 pixels, which exposes stale heap contents, such as allocator words, in the decoded output.

The CDXL decoder contains an issue where uninitialized variables lead to stack memory leakage into decoded pixels through unfilled HAM palette entries. A remote attacker can use a specially crafted type-0 CDXL file to trigger this behavior via the `cdxl decode ham8()` or `cdxl decode ham6()` functions, resulting in the exposure of stack bytes and pointer fragments within the BGR24 output.

The Huffyuv decoder contains a use of uninitialized resource issue. An attacker can leak heap memory into decoded pixels by using short packed-BGR bitstreams. By crafting a Huffyuv BGR24/BGRA video where the entropy data ends prematurely, the `decode slice()` function adds uninitialized `s->temp[0]` bytes into output frames, which exposes the contents of the heap.

An out-of-bounds heap write exists in the native GoPro CineForm HD (CFHD) decoder. A remote attacker can corrupt heap memory by providing a specially crafted AVI file during stream probing. The issue occurs because the `cfhd decode()` function does not enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path. This leads the `horiz filter clip()` function to write oversized 16-bit sample rows beyond the allocated output frame buffer, which may allow arbitrary code execution by overwriting a live cleanup callback pointer.

A signed integer overflow exists in the DVB subtitle parser within `libavcodec/dvbsub parser.c`. An attacker can trigger a heap buffer overflow by providing a specially crafted WTV file. This occurs when a bounds-check guard expression wraps to `INT MIN`, bypassing the `PARSE BUF SIZE` comparison. Consequently, the `memcpy()` function is called with attacker-controlled data, leading to an out-of-bounds heap write, which may result in memory corruption or arbitrary code execution.

The native RSCC decoder in `libavcodec/rscc.c` contains an uninitialized heap memory read issue. An attacker can disclose heap memory contents by providing a specially crafted video file containing a compressed tile that decompresses fewer bytes than the declared tile geometry requires. This occurs when the `rscc decode frame()` function calls `av image copy plane()` without validating the decompressed byte count against the tile dimensions. Consequently, the unwritten suffix of the persistent intermediate buffer `ctx->inflated buf` is copied into the decoded frame, which may expose data from previous heap allocations or previously decoded frames in persistent decoding services.

An uninitialized heap memory read exists in the native Screenpresso decoder (`libavcodec/screenpresso.c`). An attacker can recover sensitive memory contents, such as userspace addresses from persistent decoding services, by providing a crafted SPV1 packet containing a valid zlib stream that decompresses fewer bytes than the full frame requires. This occurs because the `screenpresso decode frame()` function does not validate the produced byte count before calling `av image copy plane()` to copy the frame dimensions from the `ctx->inflated buf` buffer, resulting in unwritten heap memory from previous allocations or frames being copied into the decoded output.

An uninitialized heap memory disclosure exists in the native TIFF decoder within libavcodec/tiff.c. An attacker can exploit this by providing a crafted TIFF file containing a valid Deflate-compressed strip that produces fewer bytes than declared. The `tiff unpack zlib()` function allocates a heap buffer for the full declared strip but uses `memcpy()` to copy all declared rows regardless of the actual bytes decompressed by zlib. This process incorporates unwritten bytes containing stale data from previous heap allocations into the decoded image output, which may expose sensitive information in persistent services.

A heap out-of-bounds write exists in the native PNG and APNG encoders. A remote attacker can corrupt heap memory by providing a crafted PNG image containing a malicious eXIf chunk. By creating an eXIf chunk where multiple IFD (Image File Directory) entries reference the same large value payload, the canonical serialization expands the output beyond the allocation estimated by the `add exif profile size()` function. This causes the `png write chunk()` function to write data past the buffer boundary, leading to deterministic heap corruption, process crashes, and potentially arbitrary code execution.

A heap out-of-bounds write exists in the `vf hqdn3d` filter. This occurs when filtergraph reinitialization is disabled using the `-reinit filter 0` option. An attacker can provide a crafted video where the frame resolution increases between frames. In this scenario, the `config input()` function allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause the `denoise spatial()` function to write beyond the allocated boundary, leading to heap memory corruption.

An out-of-bounds write issue exists in the `vf floodfill` video filter. This occurs when a dynamically sized video stream is supplied while filtergraph reinitialization is disabled via `-reinit filter 0`. The `config input()` function allocates the points traversal stack based on the initial frame dimensions; if a subsequent larger frame is processed, the `filter frame()` function performs flood-fill neighbor pushes beyond the original allocation boundary. This leads to heap corruption, which can cause a process crash or potentially allow arbitrary code execution depending on the heap layout and process hardening.

An out-of-bounds write exists in the `vf swaprect` video filter. This occurs when the `filter frame()` function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes. When processing a crafted NV12 video frame with odd width dimensions, such as a 17x16 frame, an 18-byte memcpy is performed into a 17-byte heap allocation for the interleaved chroma plane. This leads to heap corruption, which can cause the process to crash or potentially allow for arbitrary code execution.

An out-of-bounds write issue exists when processing a crafted ffconcat file using the `-safe 0` flag. The `demux audio()` function within the TY demuxer decrements the packet size without performing bounds checking. This results in a negative size value being passed to the `memcpy()` function inside `shorten decode frame()`. The subsequent conversion to `size t` causes the value to wrap to near `SIZE MAX`, leading to reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer, which causes heap corruption.

An out-of-bounds write issue exists in the TDSC video decoder. A remote attacker can cause heap corruption by providing a specially crafted AVI file that alters frame dimensions across TDSF frames. The `tdsc parse tdsf()` function does not unreference the current reference frame before calling `av frame get buffer()`. This leads the `tdsc blit()` and `tdsc yuv2rgb()` functions to write attacker-controlled pixel data beyond the boundaries of the undersized reference frame buffer, which can result in a process crash or potential arbitrary code execution.

The MACE6 audio decoder contains a signed integer overflow that allows heap memory corruption via a crafted CAF file. By providing oversized `bytes per packet` and `frames per packet` values in the desc chunk, an attacker can trigger an integer overflow in the `mace decode frame()` function during the computation of the output sample count. This leads to an undersized buffer allocation and a heap out-of-bounds write, which could potentially enable arbitrary code execution.

The IAMF demuxer contains an issue that allows an unauthenticated attacker to cause multi-gigabyte memory allocation using a small 17-byte input file. This occurs because the `mix presentation obu()` function in libavformat/iamf parse.c calls `av calloc()` using a crafted `count label` field before validating the available OBU (OpenGL Binary Object) data. This leads to an allocation amplification of approximately 126 million bytes per input byte, which can exhaust process memory or trigger an OOM-kill (Out-Of-Memory killer, a kernel process that terminates processes to free memory) during format probing.

An information disclosure issue exists in the LCL/ZLIB video decoder. An attacker can expose uninitialized heap memory by providing a valid zlib stream that inflates to fewer bytes than the expected frame size. The `zlib decomp()` function in `lcldec.c` treats short decompression as non-fatal and proceeds to the RGB24 conversion path. This process copies a full frame of rows from the allocation buffer based on original frame dimensions, resulting in uninitialized heap contents, such as pointer-derived allocator bytes, being copied into the AVFrame output. This could potentially defeat Address Space Layout Randomization (ASLR), a security technique that randomly arranges the address space positions of key data areas of a process to prevent exploitation.

A heap out-of-bounds write exists in the `vf quirc` filter. An attacker can corrupt heap memory by providing a crafted PGS/SUP subtitle file with mismatched frame dimensions, specifically where the second presentation has larger dimensions than the first. This causes the `av image copy plane()` function to copy data exceeding the initial allocation size into an undersized libquirc grayscale image buffer, leading to a process crash and potential arbitrary code execution.