This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/4.4 in repository ffmpeg.
commit 0c98ad41ba0c50fc5a2a9db07c7204f4b2170836 Author: Michael Niedermayer <[email protected]> AuthorDate: Sun Feb 15 00:00:55 2026 +0100 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue May 5 18:55:02 2026 +0200 avcodec/cfhd: Check transform type before continuing Fixes: null pointer dereference Fixes: 471768165/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_DEC_fuzzer-6187504467509248 The first frame allocates buffers with one transform type the second frame sets up another transform type but the code to reallocate buffers is never triggered Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 52b676bb29e9ea6af1b84a9fe7f35ad99a7502f0) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/cfhd.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c index 4031b2020b..82434dbddf 100644 --- a/libavcodec/cfhd.c +++ b/libavcodec/cfhd.c @@ -708,6 +708,11 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, if (s->subband_num_actual == 255) goto finish; + + if (tag == BitstreamMarker && data == CoefficientSegment || tag == BandHeader || tag == BandSecondPass || s->peak.level) + if (s->transform_type != s->a_transform_type) + return AVERROR_PATCHWELCOME; + coeff_data = s->plane[s->channel_num].subband[s->subband_num_actual]; /* Lowpass coefficients */ _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
