[FFmpeg-trac] #11651(undetermined:new): NULL Pointer Dereference in FFmpeg ffprobe

28 Jun 2025

      #11651: NULL Pointer Dereference in FFmpeg ffprobe
-------------------------------------+-------------------------------------
             Reporter:  momo-trip    |                     Type:  defect
               Status:  new          |                 Priority:  normal
            Component:               |                  Version:  7.1
  undetermined                       |
             Keywords:  NULL         |               Blocked By:
  pointer dereference                |
             Blocking:               |  Reproduced by developer:  0
Analyzed by developer:  0            |
-------------------------------------+-------------------------------------
 # NULL Pointer Dereference in FFmpeg ffprobe

 Hi, we have found a NULL pointer dereference in ffprobe and would like to
 report this issue.
 Could you confirm if this qualifies as a security bug? I am happy to
 provide any additional information needed.

 ## Summary
 In ffprobe's special syntax `-/opt`, when no subsequent argument exists, a
 NULL pointer is passed, causing `open(NULL, ...)` to be called and
 resulting in abnormal termination. This is reproducible with input alone,
 and in service environments that automatically execute ffprobe, this
 constitutes a DoS attack.

 ## Details
 - **Vulnerability Type:** NULL Pointer Dereference arising from Improper
 Input Validation, CWE-20
 - **Product:** FFmpeg (ffprobe)
 - **Version:** 7.1.1 (commit f11962f, 2025-05-15)
 - **Configuration:** Default settings, no additional options
 - **Attack Vector:** Local CLI (arbitrary user input)
 - **Impact:** Process abnormal termination (service interruption)
 - **Privileges Required / User Interaction:** None required / Command
 execution only

 ## Reproduction
 ### Environment
 - **Operating System:** Ubuntu 22.04 LTS
 - **Architecture:** x86-64
 - **Compiler:** clang 15.0.7 + AddressSanitizer

 ### Reproduction Steps
 ```bash
 # Clone and build (ASan enabled)
 git clone https://github.com/FFmpeg/FFmpeg.git
 cd FFmpeg
 git checkout f11962f
 ./configure --enable-gpl \
             CC=clang CFLAGS="-fsanitize=address -g -O1" \
             LDFLAGS="-fsanitize=address"
 make -j$(nproc)

 # Crash examples
 ./ffprobe -/version
 ./ffprobe -/L
 ./ffprobe -/buildconf
 ```

 ### Crash Log
 ```bash
 Output (AddressSanitizer excerpt)
 ==7854==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
     #0 0x7f2b6c in open (/usr/lib/x86_64-linux-gnu/libc.so.6+0xfa6c)
     #1 0x5605fd in file_read fftools/cmdutils.c:272
     #2 0x5632ab in parse_option fftools/cmdutils.c:266
     #3 0x564de0 in parse_options fftools/cmdutils.c:448
     ...
 AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f2b6c ...)
 ```

 ## Root Cause Analysis
 ### Affected Code
 https://github.com/FFmpeg/FFmpeg/blob/master/fftools/cmdutils.c#L431
 https://github.com/FFmpeg/FFmpeg/blob/master/fftools/cmdutils.c#L255
 ```c
 // parse_options() (approximately lines 431–441)
 opt = argv[optindex++];                 /* optindex is incremented */
 ...
 if ((ret = parse_option(optctx, opt, argv[optindex], options)) < 0)
     return ret;                         /* when optindex == argc,
 argv[...] is NULL */

 // write_option() (approximately lines 255–274)
 if (*opt == '/') {
     opt++;
     /* No validation for argument requirement or arg==NULL */
     arg_allocated = file_read(arg);     /* arg is NULL → open(NULL, ...)
 */
 }
 ```

 ## Impact Assessment
 - No elements of remote code execution or information disclosure are
 present.
 - However, in automated analysis services that launch ffprobe, it is
 possible to stop the process with a single malicious argument, affecting
 availability.

 ## Proposed Fix
 - Utilize `opt_has_arg(const OptionDef *po)` to reference `argv[optindex]`
 only for options that require arguments.
 - When `/` syntax is detected:
   - Check if the target option requires an argument; reject if not
 required.
   - If `arg == NULL`, return with "file not specified" error.

 ```c
 /* parse_options() */
 const OptionDef *po = find_option(options, name);
 if (po && opt_has_arg(po) && optindex >= argc) {
     av_log(NULL, AV_LOG_ERROR,
            "Missing argument for option '%s'\n", opt);
     return AVERROR(EINVAL);
 }

 /* -/ processing in write_option() */
 if (*opt == '/') {
     opt++;
     if (!opt_has_arg(po)) {
         av_log(NULL, AV_LOG_ERROR,
                "Option '%s' does not take an argument; '-/%s' is
 invalid\n",
                po->name, po->name);
         return AVERROR(EINVAL);
     }
     if (!arg) {
         av_log(NULL, AV_LOG_ERROR,
                "No file specified after '-/%s'\n", po->name);
         return AVERROR(EINVAL);
     }
 }
 ```
-- 
Ticket URL: <https://trac.ffmpeg.org/ticket/11651>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker