This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/4.4 in repository ffmpeg.
commit a120b52bdfe299d5aa64713a068524880d4c2012 Author: Michael Niedermayer <[email protected]> AuthorDate: Fri Jan 23 00:34:56 2026 +0100 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue May 5 18:55:00 2026 +0200 avformat/img2enc: Check split planes packet size Fixes: out of array read Fixes: VULN-6/poc.raw Found-by: Zhenpeng (Leo) Lin from depthfirst Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit ca1c1f29ce47e47e5cd1eff9fc9d2622b7a1eb0d) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/img2enc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/img2enc.c b/libavformat/img2enc.c index 0f7a21ffa0..041d228c4d 100644 --- a/libavformat/img2enc.c +++ b/libavformat/img2enc.c @@ -191,6 +191,12 @@ static int write_packet(AVFormatContext *s, AVPacket *pkt) ysize *= 2; usize *= 2; } + + if (ysize + 2*usize + (desc->nb_components > 3) * ysize > pkt->size) { + ret = AVERROR(EINVAL); + goto fail; + } + avio_write(pb[0], pkt->data , ysize); avio_write(pb[1], pkt->data + ysize , usize); avio_write(pb[2], pkt->data + ysize + usize, usize); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
