Skip to content

Bound iloc extent_count to prevent memory amplification #3375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
littlepig12345 wants to merge 4 commits into from
Closed

Bound iloc extent_count to prevent memory amplification #3375

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3ae959c
Bound iloc extent_count to prevent memory amplification
littlepig12345 Sep 24, 2026
64bae73
Bound iloc extent_count to prevent memory amplification- #3375
littlepig12345 Sep 24, 2026
730f2f7
Update read.c
littlepig12345 Sep 25, 2026
d7ea324
Bound iloc extent_count to prevent memory amplification
littlepig12345 Sep 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 19 additions & 1 deletion src/read.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2154,6 +2154,20 @@ static avifResult avifParseItemLocationBox(avifMeta * meta, const uint8_t * raw,
AVIF_CHECKERR(avifROStreamReadUX8(&s, &baseOffset, baseOffsetSize), AVIF_RESULT_BMFF_PARSE_FAILED); // unsigned int(base_offset_size*8) base_offset;
uint16_t extentCount;
AVIF_CHECKERR(avifROStreamReadU16(&s, &extentCount), AVIF_RESULT_BMFF_PARSE_FAILED); // unsigned int(16) extent_count;
const uint32_t bytesPerExtent = indexSize + offsetSize + lengthSize;
if (bytesPerExtent == 0 && extentCount > 1) {
avifDiagnosticsPrintf(diag, "Item ID [%u] declares %u extents that consume no input bytes", itemID, extentCount);
return AVIF_RESULT_BMFF_PARSE_FAILED;
}
const size_t remainingBytes = avifROStreamRemainingBytes(&s);
if ((uint64_t)extentCount * bytesPerExtent > remainingBytes) {
avifDiagnosticsPrintf(diag,
"Item ID [%u] extent_count [%u] exceeds the remaining %zu bytes of the iloc box",
itemID,
extentCount,
remainingBytes);
return AVIF_RESULT_BMFF_PARSE_FAILED;
}

@wantehchang wantehchang Sep 26, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc: @matejsmycka

Yannis: #3372 is about this very subject. This doesn't seem like a coincidence.

Something strange is going on behind the recent flurry of activities on libavif.

@matejsmycka matejsmycka Sep 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well its the usage of ai....

@y-guyon y-guyon Sep 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#3372 is about this very subject

Right, I did not look into #3372, sorry for the double work. Since this PR is about the same topic and was open after #3372, let's close this PR.

for (int extentIter = 0; extentIter < extentCount; ++extentIter) {
if ((version == 1 || version == 2) && indexSize > 0) {
// Section 8.11.3.1 of ISO/IEC 14496-12:
Expand All @@ -2169,7 +2183,11 @@ static avifResult avifParseItemLocationBox(avifMeta * meta, const uint8_t * raw,
AVIF_CHECKERR(avifROStreamReadUX8(&s, &extentOffset, offsetSize), AVIF_RESULT_BMFF_PARSE_FAILED); // unsigned int(offset_size*8) extent_offset;
uint64_t extentLength;
AVIF_CHECKERR(avifROStreamReadUX8(&s, &extentLength, lengthSize), AVIF_RESULT_BMFF_PARSE_FAILED); // unsigned int(length_size*8) extent_length;

// ISO/IEC 14496-12, Section 8.11.3.2.4.3: extent_length == 0 is not supported by libavif.
if (lengthSize > 0 && extentLength == 0) {
avifDiagnosticsPrintf(diag, "Item ID [%u] uses extent_length = 0, which is not supported", itemID);
return AVIF_RESULT_NOT_IMPLEMENTED;
}
avifExtent * extent = (avifExtent *)avifArrayPush(&item->extents);
AVIF_CHECKERR(extent != NULL, AVIF_RESULT_OUT_OF_MEMORY);
if (extentOffset > UINT64_MAX - baseOffset) {
Expand Down