heap-buffer-overflow at libavfilter/bwdifdsp.c:125:5 in ff_bwdif_filter_intra_c in FFmpeg

[ZengYunxiang]

Summary of the bug:

Dear developers, hello!
I recently proposed a new fuzzing method named fuzzyx, and found the following heap-buffer-overflow bug on FFmpeg6.1 when using bwdif filter, please confirm.

POC file link:
poc3ffmpeg: ​https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/poc3ffmpeg

How to reproduce:

git clone https://github.com/FFmpeg/FFmpeg.git ffmpeg6-1
cd ffmpeg6-1
git checkout 466799d
./configure --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-asan
make -j30

./ffmpeg_g -y -i poc3ffmpeg -filter_complex bwdif tmp.mkv

ASAN Log:

=================================================================
==716046==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61a0000afe40 at pc 0x55871b706904 bp 0x7ffd0ee6d2a0 sp 0x7ffd0ee6d298
READ of size 8 at 0x61a0000afe40 thread T0
    #0 0x55871b706903 in ff_bwdif_filter_intra_c /ffmpeg/libavfilter/bwdifdsp.c:125:5
    #1 0x55871ae6ba71 in filter_slice /ffmpeg/libavfilter/vf_bwdif.c:80:17
    #2 0x55871ad49638 in worker_func /ffmpeg/libavfilter/pthread.c:49:15
    #3 0x55871eddd45e in run_jobs /ffmpeg/libavutil/slicethread.c:65:9
    #4 0x55871eddd45e in avpriv_slicethread_execute /ffmpeg/libavutil/slicethread.c:192:19
    #5 0x55871ad494a6 in thread_execute /ffmpeg/libavfilter/pthread.c:71:5
    #6 0x55871ae6b021 in ff_filter_execute /ffmpeg/libavfilter/internal.h:147:12
    #7 0x55871ae6b021 in filter /ffmpeg/libavfilter/vf_bwdif.c:132:9
    #8 0x55871b4b2867 in return_frame /ffmpeg/libavfilter/yadif_common.c:57:5
    #9 0x55871b4b2fdf in ff_yadif_request_frame /ffmpeg/libavfilter/yadif_common.c:185:9
    #10 0x55871acdabfb in ff_request_frame_to_filter /ffmpeg/libavfilter/avfilter.c:482:15
    #11 0x55871acd5e21 in ff_filter_activate_default /ffmpeg/libavfilter/avfilter.c:1184:20
    #12 0x55871acd5e21 in ff_filter_activate /ffmpeg/libavfilter/avfilter.c:1331:11
    #13 0x55871acea5cc in get_frame_internal /ffmpeg/libavfilter/buffersink.c:139:19
    #14 0x55871ace7030 in avfilter_graph_request_oldest /afltest/ffmpegasan/libavfilter/avfiltergraph.c:1306:17
    #15 0x55871abac97f in fg_transcode_step /ffmpeg/fftools/ffmpeg_filter.c:2485:11
    #16 0x55871ac08326 in transcode_step /ffmpeg/fftools/ffmpeg.c:1134:20
    #17 0x55871ac08326 in transcode /ffmpeg/fftools/ffmpeg.c:1205:15
    #18 0x55871ac08326 in main /ffmpeg/fftools/ffmpeg.c:1331:11
    #19 0x7fe4a2370d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: a43bfc8428df6623cd498c9c0caeb91aec9be4f9)
    #20 0x7fe4a2370e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: a43bfc8428df6623cd498c9c0caeb91aec9be4f9)
    #21 0x55871aab6824 in _start (/ffmpeg/ffmpeg_g+0x90e824) (BuildId: 9832a23ddc031de766b82a345766231d990b42d2)

0x61a0000afe40 is located 64 bytes to the left of 1167-byte region [0x61a0000afe80,0x61a0000b030f)
allocated by thread T11 (av:h264:df10) here:
    #0 0x55871ab3a1e7 in __interceptor_posix_memalign (/ffmpeg/ffmpeg_g+0x9921e7) (BuildId: 9832a23ddc031de766b82a345766231d990b42d2)
    #1 0x55871ed98c21 in av_malloc /ffmpeg/libavutil/mem.c:105:9
    #2 0x55871ed376ec in av_buffer_alloc /ffmpeg/libavutil/buffer.c:82:12
    #3 0x55871ed376ec in av_buffer_allocz /ffmpeg/libavutil/buffer.c:95:24
    #4 0x55871ed3a156 in pool_alloc_buffer /ffmpeg/libavutil/buffer.c:363:26
    #5 0x55871ed3a156 in av_buffer_pool_get /ffmpeg/libavutil/buffer.c:401:15
    #6 0x55871c548777 in video_get_buffer /ffmpeg/libavcodec/get_buffer.c:240:23
    #7 0x55871c548777 in avcodec_default_get_buffer2 /ffmpeg/libavcodec/get_buffer.c:276:16
    #8 0x55871c1c2d6f in ff_get_buffer /ffmpeg/libavcodec/decode.c:1672:11
    #9 0x55871cf4a87f in thread_get_buffer_internal /ffmpeg/libavcodec/pthread_frame.c:969:11
    #10 0x55871cf4a87f in ff_thread_get_buffer /ffmpeg/libavcodec/pthread_frame.c:978:15

Thread T11 (av:h264:df10) created by T0 here:
    #0 0x55871ab22aec in __interceptor_pthread_create (/ffmpeg/ffmpeg_g+0x97aaec) (BuildId: 9832a23ddc031de766b82a345766231d990b42d2)
    #1 0x55871a9b0d4b in init_thread /ffmpeg/libavcodec/pthread_frame.c:844:11

SUMMARY: AddressSanitizer: heap-buffer-overflow /ffmpeg/libavfilter/bwdifdsp.c:125:5 in ff_bwdif_filter_intra_c
Shadow bytes around the buggy address:
  0x0c348000df70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c348000df80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c348000df90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c348000dfa0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c348000dfb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c348000dfc0: fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa
  0x0c348000dfd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c348000dfe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c348000dff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c348000e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c348000e010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==716046==ABORTING

ffmpeg version:

# ./ffmpeg -version
ffmpeg version n6.1-3-g466799d4f5 Copyright (c) 2000-2023 the FFmpeg developers
built with clang version 9.0.0 (https://github.com/llvm-mirror/llvm c62b24f070c9a4bb1a76409e623042a740cac4cd)
configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-asan
libavutil      58. 29.100 / 58. 29.100
libavcodec     60. 31.102 / 60. 31.102
libavformat    60. 16.100 / 60. 16.100
libavdevice    60.  3.100 / 60.  3.100
libavfilter     9. 12.100 /  9. 12.100
libswscale      7.  5.100 /  7.  5.100
libswresample   4. 12.100 /  4. 12.100

Credit:

Zeng Yunxiang , HUST
Song Jiaxuan , HUST

Thanks for your time!

[Cosmin Stejerean]

This can be reproduced with a simple YUV420p input with a height of 6 or lower, where after chroma subsampling the height of the chroma planes will be < 4. For example

ffmpeg -f lavfi -i testsrc=duration=1:size=16x6:rate=30 -vf format=yuv420p -y out.mp4

[Cosmin Stejerean]

Fixed by 737ede405b11a37fdd61d19cf25df296a0cb0b75