This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 8a1c2779a0 avcodec/vc1dec: check return values of all init_get_bits()
calls
8a1c2779a0 is described below
commit 8a1c2779a033bedb8e228e78747fde2fbe3c140c
Author: James Almer <[email protected]>
AuthorDate: Wed Jan 14 10:48:42 2026 -0300
Commit: James Almer <[email protected]>
CommitDate: Thu Jan 15 16:07:46 2026 -0300
avcodec/vc1dec: check return values of all init_get_bits() calls
And replace them with init_get_bits8, to prevent integer overflows on huge
values.
Fixes issue #21463.
Signed-off-by: James Almer <[email protected]>
---
libavcodec/vc1dec.c | 37 ++++++++++++++++++++++++++++---------
1 file changed, 28 insertions(+), 9 deletions(-)
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index 72bc810ce7..6bf3a7aa9b 100644
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -683,7 +683,11 @@ static av_cold int vc1_decode_init(AVCodecContext *avctx)
if (size <= 0)
continue;
buf2_size = v->vc1dsp.vc1_unescape_buffer(start + 4, size, buf2);
- init_get_bits(&gb, buf2, buf2_size * 8);
+ ret = init_get_bits8(&gb, buf2, buf2_size);
+ if (ret < 0) {
+ av_free(buf2);
+ return ret;
+ }
switch (AV_RB32(start)) {
case VC1_CODE_SEQHDR:
if ((ret = ff_vc1_decode_sequence_header(avctx, v, &gb)) < 0) {
@@ -888,8 +892,11 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame
*pict,
}
buf_size3 = v->vc1dsp.vc1_unescape_buffer(start + 4, size,
slices[n_slices].buf);
- init_get_bits(&slices[n_slices].gb, slices[n_slices].buf,
- buf_size3 << 3);
+ ret = init_get_bits8(&slices[n_slices].gb,
slices[n_slices].buf, buf_size3);
+ if (ret < 0) {
+ ret = AVERROR(ENOMEM);
+ goto err;
+ }
slices[n_slices].mby_start = avctx->coded_height + 31 >> 5;
slices[n_slices].rawbuf = start;
slices[n_slices].raw_size = size + 4;
@@ -899,7 +906,11 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame
*pict,
}
case VC1_CODE_ENTRYPOINT: /* it should be before frame data */
buf_size2 = v->vc1dsp.vc1_unescape_buffer(start + 4, size,
buf2);
- init_get_bits(&v->gb, buf2, buf_size2 * 8);
+ ret = init_get_bits8(&v->gb, buf2, buf_size2);
+ if (ret < 0) {
+ ret = AVERROR(ENOMEM);
+ goto err;
+ }
ff_vc1_decode_entry_point(avctx, v, &v->gb);
break;
case VC1_CODE_SLICE: {
@@ -918,8 +929,11 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame
*pict,
}
buf_size3 = v->vc1dsp.vc1_unescape_buffer(start + 4, size,
slices[n_slices].buf);
- init_get_bits(&slices[n_slices].gb, slices[n_slices].buf,
- buf_size3 << 3);
+ ret = init_get_bits8(&slices[n_slices].gb,
slices[n_slices].buf, buf_size3);
+ if (ret < 0) {
+ ret = AVERROR(ENOMEM);
+ goto err;
+ }
slices[n_slices].mby_start =
get_bits(&slices[n_slices].gb, 9);
slices[n_slices].rawbuf = start;
slices[n_slices].raw_size = size + 4;
@@ -952,8 +966,11 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame
*pict,
goto err;
}
buf_size3 = v->vc1dsp.vc1_unescape_buffer(divider + 4, buf +
buf_size - divider - 4, slices[n_slices].buf);
- init_get_bits(&slices[n_slices].gb, slices[n_slices].buf,
- buf_size3 << 3);
+ ret = init_get_bits8(&slices[n_slices].gb,
slices[n_slices].buf, buf_size3);
+ if (ret < 0) {
+ ret = AVERROR(ENOMEM);
+ goto err;
+ }
slices[n_slices].mby_start = s->mb_height + 1 >> 1;
slices[n_slices].rawbuf = divider;
slices[n_slices].raw_size = buf + buf_size - divider;
@@ -964,7 +981,9 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame
*pict,
} else {
buf_size2 = v->vc1dsp.vc1_unescape_buffer(buf, buf_size, buf2);
}
- init_get_bits(&v->gb, buf2, buf_size2*8);
+ ret = init_get_bits8(&v->gb, buf2, buf_size2);
+ if (ret < 0)
+ return ret;
} else{
ret = init_get_bits8(&v->gb, buf, buf_size);
if (ret < 0)
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
