heap-buffer-overflow at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg

[ZengYunxiang]

Summary of the bug:

Dear developers,

We found the following heap-buffer-overflow bug on FFmpeg(version N-113007-g8d24a28d06) when using separatefields filter, please confirm.

The poc file(poc17ffmpeg) will be attached to this ticket.

How to reproduce:

git clone https://github.com/FFmpeg/FFmpeg.git ffmpeg
cd ffmpeg
./configure --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-asan
make -j30

./ffmpeg_g -y -i poc17ffmpeg -filter_complex separatefields tmp.mp4

ASAN Log:

=================================================================
==670872==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62700000314f at pc 0x55ed4c6ba8b7 bp 0x7f222d2fdb30 sp 0x7f222d2fd300
READ of size 12288 at 0x62700000314f thread T1 (enc0:0:mpeg4)
    #0 0x55ed4c6ba8b6 in __asan_memcpy (/ffmpeg/ffmpeg_g+0x9308b6) (BuildId: bab21e45d9666c5cb0f3fbb9efc25079a5bb0a62)
    #1 0x55ed4e177a08 in load_input_picture /ffmpeg/libavcodec/mpegvideo_enc.c:1216:21
    #2 0x55ed4e177a08 in ff_mpv_encode_picture /ffmpeg/libavcodec/mpegvideo_enc.c:1765:9
    #3 0x55ed4d9ee6f1 in ff_encode_encode_cb /ffmpeg/libavcodec/encode.c:264:11
    #4 0x55ed4d9efafa in encode_simple_internal /ffmpeg/libavcodec/encode.c:350:15
    #5 0x55ed4d9efafa in encode_simple_receive_packet /ffmpeg/libavcodec/encode.c:364:15
    #6 0x55ed4d9efafa in encode_receive_packet_internal /ffmpeg/libavcodec/encode.c:398:15
    #7 0x55ed4d9ef232 in avcodec_send_frame /ffmpeg/libavcodec/encode.c:541:15
    #8 0x55ed4c710c1c in encode_frame /ffmpeg/fftools/ffmpeg_enc.c:655:11
    #9 0x55ed4c70fa93 in do_video_out /ffmpeg/fftools/ffmpeg_enc.c:808:12
    #10 0x55ed4c70fa93 in frame_encode /ffmpeg/fftools/ffmpeg_enc.c:826:47
    #11 0x55ed4c70edb6 in encoder_thread /ffmpeg/fftools/ffmpeg_enc.c:916:15
    #12 0x55ed4c75a4e8 in task_wrapper /ffmpeg/fftools/ffmpeg_sched.c:2200:21
    #13 0x7f222f409ac2  (/lib/x86_64-linux-gnu/libc.so.6+0x94ac2) (BuildId: 203de0ae33b53fee1578b117cb4123e85d0534f0)
    #14 0x7f222f49b65f  (/lib/x86_64-linux-gnu/libc.so.6+0x12665f) (BuildId: 203de0ae33b53fee1578b117cb4123e85d0534f0)

0x62700000314f is located 0 bytes to the right of 12367-byte region [0x627000000100,0x62700000314f)
allocated by thread T3 (dec0:0:h263) here:
    #0 0x55ed4c6bc107 in __interceptor_posix_memalign (/ffmpeg/ffmpeg_g+0x932107) (BuildId: bab21e45d9666c5cb0f3fbb9efc25079a5bb0a62)
    #1 0x55ed4fd41fbe in av_malloc /ffmpeg/libavutil/mem.c:105:9
    #2 0x55ed4fcf70dc in av_buffer_alloc /ffmpeg/libavutil/buffer.c:82:12
    #3 0x55ed4fcf70dc in av_buffer_allocz /ffmpeg/libavutil/buffer.c:95:24
    #4 0x55ed4fcf91b3 in pool_alloc_buffer /ffmpeg/libavutil/buffer.c:363:26
    #5 0x55ed4fcf91b3 in av_buffer_pool_get /ffmpeg/libavutil/buffer.c:401:15
    #6 0x55ed4db73c18 in video_get_buffer /ffmpeg/libavcodec/get_buffer.c:240:23
    #7 0x55ed4db73c18 in avcodec_default_get_buffer2 /ffmpeg/libavcodec/get_buffer.c:276:16
    #8 0x55ed4d8a0d93 in ff_get_buffer /ffmpeg/libavcodec/decode.c:1672:11
    #9 0x55ed4e1631d2 in alloc_picture /ffmpeg/libavcodec/mpegvideo_dec.c:250:15

Thread T1 (enc0:0:mpeg4) created by T0 here:
    #0 0x55ed4c6a4a0c in __interceptor_pthread_create (/ffmpeg/ffmpeg_g+0x91aa0c) (BuildId: bab21e45d9666c5cb0f3fbb9efc25079a5bb0a62)
    #1 0x55ed4c754a31 in task_start /ffmpeg/fftools/ffmpeg_sched.c:403:11
    #2 0x55ed4c773738 in transcode /ffmpeg/fftools/ffmpeg.c:922:11
    #3 0x55ed4c773738 in main /ffmpeg/fftools/ffmpeg.c:1050:11
    #4 0x7f222f39ed8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 203de0ae33b53fee1578b117cb4123e85d0534f0)

Thread T3 (dec0:0:h263) created by T0 here:
    #0 0x55ed4c6a4a0c in __interceptor_pthread_create (/ffmpeg/ffmpeg_g+0x91aa0c) (BuildId: bab21e45d9666c5cb0f3fbb9efc25079a5bb0a62)
    #1 0x55ed4c754a31 in task_start /ffmpeg/fftools/ffmpeg_sched.c:403:11
    #2 0x55ed4c773738 in transcode /ffmpeg/fftools/ffmpeg.c:922:11
    #3 0x55ed4c773738 in main /ffmpeg/fftools/ffmpeg.c:1050:11
    #4 0x7f222f39ed8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 203de0ae33b53fee1578b117cb4123e85d0534f0)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/ffmpeg/ffmpeg_g+0x9308b6) (BuildId: bab21e45d9666c5cb0f3fbb9efc25079a5bb0a62) in __asan_memcpy
Shadow bytes around the buggy address:
  0x0c4e7fff85d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4e7fff85e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4e7fff85f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4e7fff8600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4e7fff8610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4e7fff8620: 00 00 00 00 00 00 00 00 00[07]fa fa fa fa fa fa
  0x0c4e7fff8630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4e7fff8640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4e7fff8650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4e7fff8660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4e7fff8670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==670872==ABORTING

ffmpeg version:

# ./ffmpeg -version
ffmpeg version N-113007-g8d24a28d06 Copyright (c) 2000-2023 the FFmpeg developers
built with Ubuntu clang version 14.0.0-1ubuntu1.1
configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-asan
libavutil      58. 34.100 / 58. 34.100
libavcodec     60. 35.100 / 60. 35.100
libavformat    60. 18.100 / 60. 18.100
libavdevice    60.  4.100 / 60.  4.100
libavfilter     9. 14.100 /  9. 14.100
libswscale      7.  6.100 /  7.  6.100
libswresample   4. 13.100 /  4. 13.100

Credit:

Discovered by Zeng Yunxiang.

Thanks for your time!

[ZengYunxiang]

POC file