This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 521d18cea3 avformat/img2dec: Check avio_size() for failure
521d18cea3 is described below
commit 521d18cea3443e588f98372ce7858e8ab98fd9e0
Author: Michael Niedermayer <[email protected]>
AuthorDate: Mon Jan 5 18:07:49 2026 +0100
Commit: Michael Niedermayer <[email protected]>
CommitDate: Tue Feb 10 01:19:00 2026 +0100
avformat/img2dec: Check avio_size() for failure
More complete fix for #YWH-PGM40646-32
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/img2dec.c | 17 +++++++----------
1 file changed, 7 insertions(+), 10 deletions(-)
diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c
index 586634c0c3..ecb7ea8946 100644
--- a/libavformat/img2dec.c
+++ b/libavformat/img2dec.c
@@ -367,7 +367,6 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
int i, res;
int ret[3] = { 0 };
int64_t size[3] = { 0 };
- int64_t total_size;
AVIOContext *f[3] = { NULL };
AVCodecParameters *par = s1->streams[0]->codecpar;
@@ -458,15 +457,13 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
}
}
- total_size = size[0];
- if (total_size > INT64_MAX - size[1])
- return AVERROR_INVALIDDATA;
- total_size += size[1];
- if (total_size > INT64_MAX - size[2])
- return AVERROR_INVALIDDATA;
- total_size += size[2];
- if (total_size > INT_MAX)
- return AVERROR_INVALIDDATA;
+ int total_size = 0;
+ for (int i = 0; i < 3; i++) {
+ if ((uint64_t)size[i] > INT_MAX - total_size)
+ return AVERROR_INVALIDDATA;
+
+ total_size += size[i];
+ }
res = av_new_packet(pkt, total_size);
if (res < 0) {
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
