Skip to content

fix(Video): bounds-check bitstream indices in Vc1/Mpegv/Mpeg4v Streams_Fill #2679

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JeromeMartinez merged 1 commit into from
Sep 24, 2026
Merged

fix(Video): bounds-check bitstream indices in Vc1/Mpegv/Mpeg4v Streams_Fill #2679

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion Source/MediaInfo/Video/File_Mpeg4v.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -418,7 +418,10 @@ void File_Mpeg4v::Streams_Fill()
Fill(Stream_Video, 0, Video_Codec_Profile, Mpeg4v_Profile_Level(profile_and_level_indication));
}

if (frame_rate_code!=(int8u)-1)
// frame_rate_code is bitstream-controlled; the existing (int8u)-1 sentinel guard
// catches only 0xFF, so a crafted MPEG-4 Visual bitstream can index past the
// 16-entry Mpegv_frame_rate table -- see gh#2608.
if (frame_rate_code!=(int8u)-1 && frame_rate_code<sizeof(Mpegv_frame_rate)/sizeof(*Mpegv_frame_rate))
Fill(Stream_Video, StreamPos_Last, Video_FrameRate, Mpegv_frame_rate[frame_rate_code]);
if (bit_rate!=(int32u)-1)
Fill(Stream_Video, StreamPos_Last, Video_BitRate_Nominal, bit_rate*400);
Expand Down
30 changes: 23 additions & 7 deletions Source/MediaInfo/Video/File_Mpegv.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1274,8 +1274,13 @@ void File_Mpegv::Streams_Fill()

Fill(Stream_Video, 0, Video_Width, 0x1000*horizontal_size_extension+horizontal_size_value);
Fill(Stream_Video, 0, Video_Height, 0x1000*vertical_size_extension+vertical_size_value);
Fill(Stream_Video, 0, Video_ChromaSubsampling, Mpegv_chroma_format[chroma_format]);
Fill(Stream_Video, 0, Video_ColorSpace, Mpegv_chroma_format_Colorspace[chroma_format]);
// chroma_format is bitstream-controlled; a crafted MPEG video can pass an 8-bit
// value well past the 4-entry tables. Guard both accesses -- see gh#2612.
if (chroma_format<sizeof(Mpegv_chroma_format)/sizeof(*Mpegv_chroma_format))
{
Fill(Stream_Video, 0, Video_ChromaSubsampling, Mpegv_chroma_format[chroma_format]);
Fill(Stream_Video, 0, Video_ColorSpace, Mpegv_chroma_format_Colorspace[chroma_format]);
}
Fill(Stream_Video, 0, Video_BitDepth, 8);

//AspectRatio
Expand All @@ -1287,21 +1292,27 @@ void File_Mpegv::Streams_Fill()
Fill(Stream_Video, 0, Video_PixelAspectRatio, 1.000, 3, true);
else if (display_horizontal_size && display_vertical_size)
{
if (vertical_size_value && Mpegv_aspect_ratio2[aspect_ratio_information])
if (aspect_ratio_information<sizeof(Mpegv_aspect_ratio2)/sizeof(*Mpegv_aspect_ratio2)
&& vertical_size_value && Mpegv_aspect_ratio2[aspect_ratio_information])
Fill(Stream_Video, StreamPos_Last, Video_DisplayAspectRatio, (float)(0x1000*horizontal_size_extension+horizontal_size_value)/(0x1000*vertical_size_extension+vertical_size_value)
*Mpegv_aspect_ratio2[aspect_ratio_information]/((float)display_horizontal_size/display_vertical_size), 3, true);
}
else if (Mpegv_aspect_ratio2[aspect_ratio_information])
else if (aspect_ratio_information<sizeof(Mpegv_aspect_ratio2)/sizeof(*Mpegv_aspect_ratio2)
&& Mpegv_aspect_ratio2[aspect_ratio_information])
Fill(Stream_Video, StreamPos_Last, Video_DisplayAspectRatio, Mpegv_aspect_ratio2[aspect_ratio_information], 3, true);
}
else //Version 1
{
if (vertical_size_value && Mpegv_aspect_ratio1[aspect_ratio_information])
if (aspect_ratio_information<sizeof(Mpegv_aspect_ratio1)/sizeof(*Mpegv_aspect_ratio1)
&& vertical_size_value && Mpegv_aspect_ratio1[aspect_ratio_information])
Fill(Stream_Video, StreamPos_Last, Video_DisplayAspectRatio, (float)(0x1000*horizontal_size_extension+horizontal_size_value)/(0x1000*vertical_size_extension+vertical_size_value)/Mpegv_aspect_ratio1[aspect_ratio_information], 3, true);
}

//FrameRate
if (Mpegv_frame_rate[frame_rate_code])
// aspect_ratio_information and frame_rate_code are bitstream-controlled -- same class
// of guard as chroma_format above (gh#2612).
if (frame_rate_code<sizeof(Mpegv_frame_rate)/sizeof(*Mpegv_frame_rate)
&& Mpegv_frame_rate[frame_rate_code])
Fill(Stream_Video, StreamPos_Last, Video_FrameRate, Mpegv_frame_rate[frame_rate_code] * (frame_rate_extension_n + 1) / (frame_rate_extension_d + 1));

//BitRate
Expand Down Expand Up @@ -1373,7 +1384,12 @@ void File_Mpegv::Streams_Fill()
}

//Profile
if (!profile_and_level_indication_escape && profile_and_level_indication_profile!=(int8u)-1 && profile_and_level_indication_level!=(int8u)-1)
// profile_and_level_indication_profile / _level are bitstream-controlled; the
// existing (int8u)-1 guards only catch 0xFF, so a crafted stream can index past
// Mpegv_profile_and_level_indication_profile/_level (both char *[16]).
if (!profile_and_level_indication_escape
&& profile_and_level_indication_profile<sizeof(Mpegv_profile_and_level_indication_profile)/sizeof(*Mpegv_profile_and_level_indication_profile)
&& profile_and_level_indication_level<sizeof(Mpegv_profile_and_level_indication_level)/sizeof(*Mpegv_profile_and_level_indication_level))
{
Fill(Stream_Video, 0, Video_Format_Profile, Ztring().From_UTF8(Mpegv_profile_and_level_indication_profile[profile_and_level_indication_profile])+__T("@")+Ztring().From_UTF8(Mpegv_profile_and_level_indication_level[profile_and_level_indication_level]));
Fill(Stream_Video, 0, Video_Codec_Profile, Ztring().From_UTF8(Mpegv_profile_and_level_indication_profile[profile_and_level_indication_profile])+__T("@")+Ztring().From_UTF8(Mpegv_profile_and_level_indication_level[profile_and_level_indication_level]));
Expand Down
12 changes: 9 additions & 3 deletions Source/MediaInfo/Video/File_Vc1.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,23 +274,29 @@ void File_Vc1::Streams_Accept()
void File_Vc1::Streams_Fill()
{
//Calculating - PixelAspectRatio
// AspectRatio, profile and colordiff_format come straight from the bitstream;
// 0x0F is the 'custom AR' escape and (int8u)-1 the 'unset' sentinel, but a crafted
// VC-1 stream can supply any 8-bit value up to 0xFE and slip past both guards into
// Vc1_PixelAspectRatio[16] / Vc1_Profile[4] / Vc1_ChromaSubsamplingFormat[4] --
// see gh#2611.
float32 PixelAspectRatio;
if (AspectRatio!=0x0F)
if (AspectRatio!=0x0F && AspectRatio<sizeof(Vc1_PixelAspectRatio)/sizeof(*Vc1_PixelAspectRatio))
PixelAspectRatio=Vc1_PixelAspectRatio[AspectRatio];
else if (AspectRatioY)
PixelAspectRatio=((float)AspectRatioX)/((float)AspectRatioY);
else
PixelAspectRatio=1; //Unknown

Ztring Profile;
if (profile!=(int8u)-1)
if (profile!=(int8u)-1 && profile<sizeof(Vc1_Profile)/sizeof(*Vc1_Profile))
Profile=Vc1_Profile[profile];
if (profile==3 && level!=(int8u)-1)
Profile+=__T("@L")+Ztring::ToZtring(level);
Fill(Stream_Video, 0, Video_Format_Profile, Profile);
Fill(Stream_Video, 0, Video_Codec_Profile, Profile);
Fill(Stream_Video, 0, Video_ColorSpace, "YUV");
Fill(Stream_Video, 0, Video_ChromaSubsampling, Vc1_ChromaSubsamplingFormat[colordiff_format]);
if (colordiff_format<sizeof(Vc1_ChromaSubsamplingFormat)/sizeof(*Vc1_ChromaSubsamplingFormat))
Fill(Stream_Video, 0, Video_ChromaSubsampling, Vc1_ChromaSubsamplingFormat[colordiff_format]);
if (coded_width && coded_height)
{
Fill(Stream_Video, StreamPos_Last, Video_Width, (coded_width+1)*2);
Expand Down
Loading