This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new ca1c1f29ce avformat/img2enc: Check split planes packet size
ca1c1f29ce is described below
commit ca1c1f29ce47e47e5cd1eff9fc9d2622b7a1eb0d
Author: Michael Niedermayer <[email protected]>
AuthorDate: Fri Jan 23 00:34:56 2026 +0100
Commit: Michael Niedermayer <[email protected]>
CommitDate: Tue Feb 10 00:54:41 2026 +0100
avformat/img2enc: Check split planes packet size
Fixes: out of array read
Fixes: VULN-6/poc.raw
Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/img2enc.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavformat/img2enc.c b/libavformat/img2enc.c
index 62ec5be64b..b11f62d85d 100644
--- a/libavformat/img2enc.c
+++ b/libavformat/img2enc.c
@@ -217,6 +217,11 @@ static int write_packet(AVFormatContext *s, AVPacket *pkt)
ysize *= 2;
usize *= 2;
}
+ if (ysize + 2*usize + (desc->nb_components > 3) * ysize > pkt->size) {
+ ret = AVERROR(EINVAL);
+ goto fail;
+ }
+
if ((ret = write_and_close(s, &pb[0], pkt->data ,
ysize)) < 0 ||
(ret = write_and_close(s, &pb[1], pkt->data + ysize ,
usize)) < 0 ||
(ret = write_and_close(s, &pb[2], pkt->data + ysize + usize,
usize)) < 0)
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
