From dabb522cf66bd0576d7a6b135845915602ee2f86 Mon Sep 17 00:00:00 2001 From: Walid Chtioui Date: Wed, 8 Jul 2026 04:41:17 +0200 Subject: [PATCH] Fix out-of-bounds memory access with DFD MODEL Fix out-of-bounds memory access issue with erroneous inputs with very small DFD where KHR_DFDVAL(block, MODEL) is used to perform array access (i.e., block[KHR_DF_WORD_MODEL]) BEFORE checking the actual size of the allocated block. This is fixed by moving DFD MODEL access after sizeof_BDFD check. Signed-off-by: Walid Chtioui --- printdfd.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/printdfd.c b/printdfd.c index bde851b..b9adb8b 100644 --- a/printdfd.c +++ b/printdfd.c @@ -941,8 +941,6 @@ void printDFDJSON(uint32_t* DFD, uint32_t dataSize, uint32_t base_indent, uint32 const khr_df_versionnumber_e versionNumber = KHR_DFDVAL(block, VERSIONNUMBER); const uint32_t blockSize = KHR_DFDVAL(block, DESCRIPTORBLOCKSIZE); - const int model = KHR_DFDVAL(block, MODEL); - if (i == 0) { printf("%s", nl); } else { @@ -968,6 +966,7 @@ void printDFDJSON(uint32_t* DFD, uint32_t dataSize, uint32_t base_indent, uint32 printFlagBitsJSON(LENGTH_OF_INDENT(3), nl, flags, dfdToStringFlagsBit); PRINT_INDENT(2, "],%s", nl) + const int model = KHR_DFDVAL(block, MODEL); PRINT_ENUM_C(2, "transferFunction", KHR_DFDVAL(block, TRANSFER), dfdToStringTransferFunction); PRINT_ENUM_C(2, "colorPrimaries", KHR_DFDVAL(block, PRIMARIES), dfdToStringColorPrimaries); PRINT_ENUM_C(2, "colorModel", model, dfdToStringColorModel);