Bug Hunter Diary

The expected behavior of FFmpeg is shown in Figure 4-2 asfollows:1. fourxm->tracks is initialized with NULL (see line 107).2. If the processed media file contains a strk chunk, the value ofcurrent_track is extracted from the user-controlled data of thechunk (see line 166).3. If the value of current_track + 1 is greater than zero, a heap bufferis allocated.4. The heap buffer pointed to by fourxm->tracks is allocated (seelines 171 and 172).5. Data from the media file is copied into the heap buffer, whilecurrent_track is used as an array index into the buffer (seelines 178–181).6. When this behavior occurs, there is no security problem.4X movie file(1)fourxm->tracks = NULLstrk(2) (4)current_track+1 > 0fourxm->tracks =(3) av_realloc(..)(5)fourxm->tracks[current_track].adpcm =AV_RL32(&header[i + 12])(6)No problemFigure 4-2: Expected behavior when FFmpeg operates normallyFigure 4-3 shows what happens when this bug affects FFmpeg:1. fourxm->tracks is initialized with NULL (see line 107).2. If the processed media file contains a strk chunk, the value ofcurrent_track is extracted from the user-controlled data of thechunk (see line 166).3. If the value of current_track + 1 is less than zero, the heap bufferisn’t allocated.4. fourxm->tracks still points to memory address NULL.NULL Pointer FTW 55