heap-buffer-overflow from libavformat/movenc.c

[Suhwan]

Summary of the bug:
There is heap-buffer-overflow from libavformat/movenc.c:2049:28 in mov_write_video_tag due to the out of bounds in libavformat/movenc.c:2049

libavformat/movenc.c:2049:28: runtime error: index 256 out of bounds for type 'uint32_t [256]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavformat/movenc.c:2049:28 in

==28470==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000004f30 at pc 0x0000021b9777 bp 0x7fff9a2c5270 sp 0x7fff9a2c5268
READ of size 4 at 0x621000004f30 thread T0
    #0 0x21b9776 in mov_write_video_tag ffmpeg/libavformat/movenc.c:2049:28
    #1 0x2197fff in mov_write_stsd_tag ffmpeg/libavformat/movenc.c:2269:15
    #2 0x2197fff in mov_write_stbl_tag ffmpeg/libavformat/movenc.c:2490
    #3 0x21866e4 in mov_write_minf_tag ffmpeg/libavformat/movenc.c:2757:16
    #4 0x21866e4 in mov_write_mdia_tag ffmpeg/libavformat/movenc.c:2811
    #5 0x21866e4 in mov_write_trak_tag ffmpeg/libavformat/movenc.c:3187
    #6 0x217f127 in mov_write_moov_tag ffmpeg/libavformat/movenc.c:4012:23
    #7 0x2159a98 in mov_write_trailer ffmpeg/libavformat/movenc.c
    #8 0x23269ac in av_write_trailer ffmpeg/libavformat/mux.c:1283:15
    #9 0x5ee7e0 in transcode ffmpeg/fftools/ffmpeg.c:4726:20
    #10 0x5db6eb in main ffmpeg/fftools/ffmpeg.c:4894:9
    #11 0x7fb4ca6d0b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #12 0x41df89 in _start (ffmpeg_g+0x41df89)

0x621000004f30 is located 0 bytes to the right of 4656-byte region [0x621000003d00,0x621000004f30)
allocated by thread T0 here:
    #0 0x4dea78 in posix_memalign (ffmpeg_g+0x4dea78)
    #1 0x852e9ea in av_malloc ffmpeg/libavutil/mem.c:87:9
    #2 0x852e9ea in av_mallocz ffmpeg/libavutil/mem.c:238
    #3 0x852e9ea in av_mallocz_array ffmpeg/libavutil/mem.c:195
    #4 0x215ea7c in mov_init ffmpeg/libavformat/movenc.c:6245:19
    #5 0x230591f in avformat_init_output ffmpeg/libavformat/mux.c:418:20
    #6 0x2309ece in avformat_write_header ffmpeg/libavformat/mux.c:515:20

SUMMARY: AddressSanitizer: heap-buffer-overflow ffmpeg/libavformat/movenc.c:2049:28 in mov_write_video_tag

How to reproduce:

% ./ffmpeg_g -t 3 -stream_loop 2 -y -i screen_codec.wmv -loglevel 0 -map 0 -c copy -aframes 47 -r 102 -b:v 873k -strict 0 tmp.mov

ffmpeg version N-94982-gea673a0edb Copyright (c) 2000-2019 the FFmpeg developers
  built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final)
  configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-asan

[Suhwan]

poc

[Michael Niedermayer]

Will submit a patch to ffmpeg-devel

[Michael Niedermayer]

Patch here: ​https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2021-May/280738.html
will apply the patch soon