L.S., On Wed, Feb 11, 2026 at 9:28 AM Ard Biesheuvel <[email protected]> wrote: > > From: Ard Biesheuvel <[email protected]> >
This message is a duplicate and may be disregarded - due to poor coordination between my colleague and myself (mea culpa), we ended up sending the same patch twice, via different channels. Please refer to this version instead: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21730 > The IMA MAGIX decoder calculates the output buffer size (nb_samples) > based on the actual input packet size (buf_size) via get_nb_samples(). > However, the decoding loop previously relied on avctx->block_align to > determine the iteration count. > > When block_align is larger than the actual packet size (e.g., a 71-byte > packet with block_align=16384), the loop attempts to process more data > than available. This results in out-of-bounds reads from the input > bytestream and out-of-bounds writes to the allocated output buffer. > > Fix this by adding a check for remaining input bytes (>= 8) to the loop > condition, ensuring the loop terminates when the input is exhausted. > > oss-fuzz: https://oss-fuzz.com/testcase-detail/4847227777646592 > Co-authored-by: CodeMender <[email protected]> > Signed-off-by: Ard Biesheuvel <[email protected]> > --- > libavcodec/adpcm.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c > index bd9ad2933f..2828cb8c31 100644 > --- a/libavcodec/adpcm.c > +++ b/libavcodec/adpcm.c > @@ -1799,7 +1799,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, > AVFrame *frame, > } > } > > - for (int m = 0; m < avctx->block_align-8; m += 8) { > + for (int m = 0; m < avctx->block_align-8 && > bytestream2_get_bytes_left(&gb) >= 8; m += 8) { > uint32_t v0 = bytestream2_get_le32u(&gb); > uint32_t v1 = bytestream2_get_le32u(&gb); > > -- > 2.53.0.239.g8d8fc8a987-goog > _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
