This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 2ad078b589 avcodec/exif: Check that the values read exist in the input
2ad078b589 is described below
commit 2ad078b589a5cc735f2e0065daa0918c83343b8a
Author: Michael Niedermayer <[email protected]>
AuthorDate: Tue Feb 10 13:36:03 2026 +0100
Commit: michaelni <[email protected]>
CommitDate: Sat Feb 14 18:52:43 2026 +0000
avcodec/exif: Check that the values read exist in the input
Fixes: Timeout
Fixes:
471568865/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4864048211755008
Fixes:
471951381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_DEC_fuzzer-5069855998148608
Fixes:
471472005/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_DEC_fuzzer-4660042365468672
Fixes:
471591900/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5083936243122176
Fixes:
471593729/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_DEC_fuzzer-5401314998943744
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavcodec/exif.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavcodec/exif.c b/libavcodec/exif.c
index a184733e80..e422b28b8d 100644
--- a/libavcodec/exif.c
+++ b/libavcodec/exif.c
@@ -270,6 +270,9 @@ static inline void tput64(PutByteContext *pb, const int le,
const uint64_t value
static int exif_read_values(void *logctx, GetByteContext *gb, int le,
AVExifEntry *entry)
{
+ if (exif_sizes[entry->type] * entry->count >
bytestream2_get_bytes_left(gb))
+ return AVERROR_INVALIDDATA;
+
switch (entry->type) {
case AV_TIFF_SHORT:
case AV_TIFF_LONG:
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
