memory leaks in audio_element_obu(), libavformat/iamf_parse.c

[0x20z]

Summary of the bug:

Dear developers,
I have discovered a memory leaks vulnerability. The POC file is attached to the session, and the version of ffmpeg is the main branch. Please confirm.

How to reproduce:

git clone https://github.com/FFmpeg/FFmpeg.git
cd FFmpeg
./configure --cc=clang --cxx=clang++ --toolchain=clang-asan --extra-cflags="-I$HOME/ffmpeg_build/include -O0 -fno-omit-frame-pointer -g"   --extra-cxxflags="-O0 -fno-omit-frame-pointer -g" --extra-ldflags="-L$HOME/ffmpeg_build/include -fsanitize=address -fsanitize=undefined -lubsan" --disable-optimizations --disable-stripping --enable-cross-compile
make -j30
./ffmpeg -y -i poc tmp.mp4

LeakSanitizer:

=================================================================
==1846931==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 64 byte(s) in 1 object(s) allocated from:
    #0 0x7fdae0ab557c in __interceptor_posix_memalign ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:226
    #1 0x563a6f92e54d in av_malloc libavutil/mem.c:107
    #2 0x563a6f92ffdb in av_mallocz libavutil/mem.c:258
    #3 0x563a6f904b8d in av_iamf_param_definition_alloc libavutil/iamf.c:201
    #4 0x563a6b1264d4 in param_parse libavformat/iamf_parse.c:531
    #5 0x563a6b129f19 in audio_element_obu libavformat/iamf_parse.c:750
    #6 0x563a6b13042c in ff_iamfdec_read_descriptors libavformat/iamf_parse.c:1112
    #7 0x563a6a8189d5 in iamf_read_header libavformat/iamfdec.c:78
    #8 0x563a6a605797 in avformat_open_input libavformat/demux.c:308
    #9 0x563a69047fb9 in ifile_open fftools/ffmpeg_demux.c:1727
    #10 0x563a69106761 in open_files fftools/ffmpeg_opt.c:1362
    #11 0x563a6910732a in ffmpeg_parse_options fftools/ffmpeg_opt.c:1411
    #12 0x563a69187183 in main fftools/ffmpeg.c:974
    #13 0x7fdadfe29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: 64 byte(s) leaked in 1 allocation(s

Found by:

Found by 0x20z

Thank you for your time and attention

[James]

Should be fixed in 0526535cd58444dd264e810b2f3348b4d96cff3b

[Dominik Mierzejewski]

This is CVE-2025-1816.