heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column in FFmpeg7.0

[ZengYunxiang]

Summary of the bug:

Dear developers,

We found the following heap-buffer-overflow bug on FFmpeg(version 7.0) when using tiltandshift filter, please confirm.

The poc file(poc22ffmpeg) will be attached to this ticket.

How to reproduce:

tar -xvf ffmpeg-7.0.tar.xz
cd ffmpeg-7.0
./configure --cc=afl-clang-fast --cxx=afl-clang-fast++ --disable-shared
AFL_USE_ASAN=1 make -j30

./ffmpeg_g -y -i poc22ffmpeg -filter_complex tiltandshift tmp.mp4

ASAN Log:

=================================================================
==2083246==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000013440 at pc 0x564e02fe64ca bp 0x7fa1036fbab0 sp 0x7fa1036fb280
WRITE of size 1 at 0x631000013440 thread T2 (fc0)
    #0 0x564e02fe64c9 in __asan_memcpy (/ffmpeg-7.0/ffmpeg_g+0x9a24c9) (BuildId: 545ccc2062eaee7e775c86df925c8f1fb97035e3)
    #1 0x564e0753d519 in image_copy_plane /ffmpeg-7.0/libavutil/imgutils.c:353:9
    #2 0x564e0753e811 in image_copy /ffmpeg-7.0/libavutil/imgutils.c:415:13
    #3 0x564e0753db54 in av_image_copy /ffmpeg-7.0/libavutil/imgutils.c:434:5
    #4 0x564e037fd38b in copy_column /ffmpeg-7.0/libavfilter/vf_tiltandshift.c:189:5
    #5 0x564e037fd38b in output_frame /ffmpeg-7.0/libavfilter/vf_tiltandshift.c:235:13
    #6 0x564e037fde7a in request_frame /ffmpeg-7.0/libavfilter/vf_tiltandshift.c:298:19
    #7 0x564e031a380b in ff_request_frame_to_filter /ffmpeg-7.0/libavfilter/avfilter.c:520:15
    #8 0x564e0319ea0b in forward_status_change /ffmpeg-7.0/libavfilter/avfilter.c:1188:19
    #9 0x564e0319ea0b in ff_filter_activate_default /ffmpeg-7.0/libavfilter/avfilter.c:1232:20
    #10 0x564e0319ea0b in ff_filter_activate /ffmpeg-7.0/libavfilter/avfilter.c:1386:11
    #11 0x564e031ba906 in push_frame /ffmpeg-7.0/libavfilter/buffersrc.c:184:15
    #12 0x564e031ba906 in av_buffersrc_close /ffmpeg-7.0/libavfilter/buffersrc.c:284:47
    #13 0x564e03050dfd in send_eof /ffmpeg-7.0/fftools/ffmpeg_filter.c:2527:15
    #14 0x564e03050dfd in filter_thread /ffmpeg-7.0/fftools/ffmpeg_filter.c:2832:19
    #15 0x564e030b27d2 in task_wrapper /ffmpeg-7.0/fftools/ffmpeg_sched.c:2447:11
    #16 0x7fa106178ac2  (/lib/x86_64-linux-gnu/libc.so.6+0x94ac2) (BuildId: a43bfc8428df6623cd498c9c0caeb91aec9be4f9)
    #17 0x7fa10620aa3f  (/lib/x86_64-linux-gnu/libc.so.6+0x126a3f) (BuildId: a43bfc8428df6623cd498c9c0caeb91aec9be4f9)

0x631000013440 is located 0 bytes to the right of 76864-byte region [0x631000000800,0x631000013440)
allocated by thread T2 (fc0) here:
    #0 0x564e02fe7c67 in __interceptor_posix_memalign (/ffmpeg-7.0/ffmpeg_g+0x9a3c67) (BuildId: 545ccc2062eaee7e775c86df925c8f1fb97035e3)
    #1 0x564e0754f9d1 in av_malloc /ffmpeg-7.0/libavutil/mem.c:105:9
    #2 0x564e074e9b6c in av_buffer_alloc /ffmpeg-7.0/libavutil/buffer.c:82:12
    #3 0x564e074e9b6c in av_buffer_allocz /ffmpeg-7.0/libavutil/buffer.c:95:24
    #4 0x564e074ec5d6 in pool_alloc_buffer /ffmpeg-7.0/libavutil/buffer.c:363:26
    #5 0x564e074ec5d6 in av_buffer_pool_get /ffmpeg-7.0/libavutil/buffer.c:401:15
    #6 0x564e03201ca5 in ff_frame_pool_get /ffmpeg-7.0/libavfilter/framepool.c:217:29
    #7 0x564e0395adfe in ff_default_get_video_buffer2 /ffmpeg-7.0/libavfilter/video.c:96:13
    #8 0x564e037fc33e in output_frame /ffmpeg-7.0/libavfilter/vf_tiltandshift.c:199:20
    #9 0x564e037fde7a in request_frame /ffmpeg-7.0/libavfilter/vf_tiltandshift.c:298:19

Thread T2 (fc0) created by T0 here:
    #0 0x564e02fd056c in __interceptor_pthread_create (/ffmpeg-7.0/ffmpeg_g+0x98c56c) (BuildId: 545ccc2062eaee7e775c86df925c8f1fb97035e3)
    #1 0x564e030aad23 in task_start /ffmpeg-7.0/fftools/ffmpeg_sched.c:416:11

SUMMARY: AddressSanitizer: heap-buffer-overflow (/ffmpeg-7.0/ffmpeg_g+0x9a24c9) (BuildId: 545ccc2062eaee7e775c86df925c8f1fb97035e3) in __asan_memcpy
Shadow bytes around the buggy address:
  0x0c627fffa630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c627fffa640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c627fffa650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c627fffa660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c627fffa670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c627fffa680: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
  0x0c627fffa690: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c627fffa6a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c627fffa6b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c627fffa6c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c627fffa6d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2083246==ABORTING

ffmpeg version:

# ./ffmpeg -version
ffmpeg version 7.0 Copyright (c) 2000-2024 the FFmpeg developers
built with Ubuntu clang version 14.0.0-1ubuntu1.1
configuration: --cc=afl-clang-fast --cxx=afl-clang-fast++ --disable-shared
libavutil      59.  8.100 / 59.  8.100
libavcodec     61.  3.100 / 61.  3.100
libavformat    61.  1.100 / 61.  1.100
libavdevice    61.  1.100 / 61.  1.100
libavfilter    10.  1.100 / 10.  1.100
libswscale      8.  1.100 /  8.  1.100
libswresample   5.  1.100 /  5.  1.100

Credit:

Discovered by Zeng Yunxiang.

Thanks for your time!

[ZengYunxiang]

POC file

[ZengYunxiang]

reproduce compile command:

tar -xvf ffmpeg-7.0.tar.xz
cd ffmpeg-7.0
./configure --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-asan
make -j30

./ffmpeg_g -y -i poc22ffmpeg -filter_complex tiltandshift tmp.mp4

[James]

Fixed in a528a54ee119dcba47e7c9e30d3a56206fbad416.