PR #23778 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23778 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23778.patch
Fixes: out of array access Fixes: 2jy_poc_codec2.zip / poc_codec2.raw Fixes: jOQASNnOm6O7 Found-by: Jiale Yao <[email protected]> >From 778ff880f8dde5699d63daada7cf4fc8a9aa2559 Mon Sep 17 00:00:00 2001 From: Jiale Yao <[email protected]> Date: Sat, 11 Jul 2026 16:46:26 +0200 Subject: [PATCH] avcodec/libcodec2: reject packet sample counts that overflow int Fixes: out of array access Fixes: 2jy_poc_codec2.zip / poc_codec2.raw Fixes: jOQASNnOm6O7 Found-by: Jiale Yao <[email protected]> --- libavcodec/libcodec2.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/libcodec2.c b/libavcodec/libcodec2.c index 8895865721..ca74b2beb6 100644 --- a/libavcodec/libcodec2.c +++ b/libavcodec/libcodec2.c @@ -132,6 +132,8 @@ static int libcodec2_decode(AVCodecContext *avctx, AVFrame *frame, int16_t *output; nframes = pkt->size / avctx->block_align; + if (nframes > INT_MAX / avctx->frame_size) + return AVERROR_INVALIDDATA; frame->nb_samples = avctx->frame_size * nframes; ret = ff_get_buffer(avctx, frame, 0); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
