This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch release/8.1
in repository ffmpeg.
The following commit(s) were added to refs/heads/release/8.1 by this push:
new 0ab823b47a avcodec/bsf/extract_extradata: Check that block_size is not
negative
0ab823b47a is described below
commit 0ab823b47a5bc18118c81798f3ece7e9c6702ea2
Author: Michael Niedermayer <[email protected]>
AuthorDate: Sat Mar 7 22:02:08 2026 +0100
Commit: James Almer <[email protected]>
CommitDate: Sun Mar 8 20:36:52 2026 -0300
avcodec/bsf/extract_extradata: Check that block_size is not negative
Fixes: out of array access
Fixes:
490576036/clusterfuzz-testcase-minimized-ffmpeg_BSF_EXTRACT_EXTRADATA_fuzzer-4605696279904256
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 248b481c337d917e0fece9555ae59b5375c725c6)
Signed-off-by: James Almer <[email protected]>
---
libavcodec/bsf/extract_extradata.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/libavcodec/bsf/extract_extradata.c
b/libavcodec/bsf/extract_extradata.c
index 306ede5136..08293ea7e1 100644
--- a/libavcodec/bsf/extract_extradata.c
+++ b/libavcodec/bsf/extract_extradata.c
@@ -304,7 +304,8 @@ static int write_lcevc_nalu(AVBSFContext *ctx,
PutByteContext *pbc, const H2645N
while (bytestream2_get_bytes_left(&gbc) > 1) {
GetBitContext gb;
- int payload_size_type, payload_type, payload_size;
+ int payload_size_type, payload_type;
+ uint64_t payload_size;
int block_size, raw_block_size, block_end;
init_get_bits8(&gb, gbc.buffer, bytestream2_get_bytes_left(&gbc));
@@ -317,6 +318,9 @@ static int write_lcevc_nalu(AVBSFContext *ctx,
PutByteContext *pbc, const H2645N
if (payload_size_type == 7)
payload_size = get_mb(&gb);
+ if (payload_size > INT_MAX - (get_bits_count(&gb) >> 3))
+ return AVERROR_INVALIDDATA;
+
block_size = raw_block_size = payload_size + (get_bits_count(&gb) >>
3);
if (block_size >= bytestream2_get_bytes_left(&gbc))
return AVERROR_INVALIDDATA;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
