This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/4.4 in repository ffmpeg.
commit 6bef292824ec77992f4fe3dc1b5fe3712462add3 Author: Michael Niedermayer <[email protected]> AuthorDate: Mon Jan 5 18:07:49 2026 +0100 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue May 5 18:55:00 2026 +0200 avformat/img2dec: Check avio_size() for failure More complete fix for #YWH-PGM40646-32 Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 521d18cea3443e588f98372ce7858e8ab98fd9e0) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/img2dec.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c index 4ef0309aec..50da5fe5b9 100644 --- a/libavformat/img2dec.c +++ b/libavformat/img2dec.c @@ -411,7 +411,6 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) int i, res; int ret[3] = { 0 }; int64_t size[3] = { 0 }; - int64_t total_size; AVIOContext *f[3] = { NULL }; AVCodecParameters *par = s1->streams[0]->codecpar; @@ -492,15 +491,13 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) } } - total_size = size[0]; - if (total_size > INT64_MAX - size[1]) - return AVERROR_INVALIDDATA; - total_size += size[1]; - if (total_size > INT64_MAX - size[2]) - return AVERROR_INVALIDDATA; - total_size += size[2]; - if (total_size > INT_MAX) - return AVERROR_INVALIDDATA; + int total_size = 0; + for (int i = 0; i < 3; i++) { + if ((uint64_t)size[i] > INT_MAX - total_size) + return AVERROR_INVALIDDATA; + + total_size += size[i]; + } res = av_new_packet(pkt, total_size); if (res < 0) { _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
