This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/4.4 in repository ffmpeg.
commit c0c37cd04f41b89e9eaf4c2355b3a641f93a587b Author: Michael Niedermayer <[email protected]> AuthorDate: Wed Nov 12 03:05:15 2025 +0100 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue May 5 18:54:56 2026 +0200 avcodec/omx: Check extradata size and nFilledLen No testcase, its unknown if this is a real issue Reported-by: Peter Teoh <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit fc8a614f3d8c346acb97916320567addde433ad7) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/omx.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/omx.c b/libavcodec/omx.c index 0a6a308309..fa9d449789 100644 --- a/libavcodec/omx.c +++ b/libavcodec/omx.c @@ -683,6 +683,11 @@ static av_cold int omx_encode_init(AVCodecContext *avctx) buffer = get_buffer(&s->output_mutex, &s->output_cond, &s->num_done_out_buffers, s->done_out_buffers, 1); if (buffer->nFlags & OMX_BUFFERFLAG_CODECCONFIG) { + if (buffer->nFilledLen > INT32_MAX - AV_INPUT_BUFFER_PADDING_SIZE - avctx->extradata_size) { + ret = AVERROR(ENOMEM); + goto fail; + } + if ((ret = av_reallocp(&avctx->extradata, avctx->extradata_size + buffer->nFilledLen + AV_INPUT_BUFFER_PADDING_SIZE)) < 0) { avctx->extradata_size = 0; goto fail; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
