This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 1bde76da89 avcodec/dvdsub_parser: Fix buf_size check
1bde76da89 is described below
commit 1bde76da890127608744c3b17669a99d2adce54a
Author: Michael Niedermayer <[email protected]>
AuthorDate: Fri Mar 20 23:38:14 2026 +0100
Commit: michaelni <[email protected]>
CommitDate: Sun Mar 22 00:33:26 2026 +0000
avcodec/dvdsub_parser: Fix buf_size check
Fixes: signed integer overflow
Fixes: out of array access
Fixes: dvdsub_int_overflow_mixed_ps.mpg
Found-by: Quang Luong of Calif.io in collaboration with OpenAI Codex
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavcodec/dvdsub_parser.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/dvdsub_parser.c b/libavcodec/dvdsub_parser.c
index e728c8120d..6ac218315f 100644
--- a/libavcodec/dvdsub_parser.c
+++ b/libavcodec/dvdsub_parser.c
@@ -60,7 +60,7 @@ static int dvdsub_parse(AVCodecParserContext *s,
pc->packet = av_malloc(pc->packet_len + AV_INPUT_BUFFER_PADDING_SIZE);
}
if (pc->packet) {
- if (pc->packet_index + buf_size <= pc->packet_len) {
+ if (buf_size <= pc->packet_len - pc->packet_index) {
memcpy(pc->packet + pc->packet_index, buf, buf_size);
pc->packet_index += buf_size;
if (pc->packet_index >= pc->packet_len) {
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
