PR #23661 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661.patch
Fixes: out of array read Fixes: yBSax492UIB9 Fixes: 482d98f69b2 (spdifenc: IEC 61937 encapsulation of DTS-HD for HDMI) Found-by: Pavel Kohout (Aisle Research) Signed-off-by: Michael Niedermayer <[email protected]> >From 4fc9fbc9a150cd995f865fd2002aeb81a058d325 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 30 Jun 2026 00:11:50 +0200 Subject: [PATCH] avformat/spdifenc: bound DTS core_size against the packet size in the HD path Fixes: out of array read Fixes: yBSax492UIB9 Fixes: 482d98f69b2 (spdifenc: IEC 61937 encapsulation of DTS-HD for HDMI) Found-by: Pavel Kohout (Aisle Research) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/spdifenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/spdifenc.c b/libavformat/spdifenc.c index ab3f73da0d..16eebda01c 100644 --- a/libavformat/spdifenc.c +++ b/libavformat/spdifenc.c @@ -225,7 +225,7 @@ static int spdif_header_dts4(AVFormatContext *s, AVPacket *pkt, int core_size, * (dtshd_fallback == 0) */ ctx->dtshd_skip = 1; } - if (ctx->dtshd_skip && core_size) { + if (ctx->dtshd_skip && core_size && core_size <= pkt->size) { pkt_size = core_size; if (ctx->dtshd_fallback >= 0) --ctx->dtshd_skip; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
