This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/4.4 in repository ffmpeg.
commit 7e9f8fe7f99a145d924e7aef6b34c32e2b1637ce Author: Michael Niedermayer <[email protected]> AuthorDate: Sat Nov 1 02:02:44 2025 +0100 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue May 5 18:55:11 2026 +0200 avformat/rtpdec_qdm2: Check block_size Fixes: out of array access no testcase Found-by: Joshua Rogers <[email protected]> with ZeroPath Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 29a097385573645590418db12cc340f4bd60be7c) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/rtpdec_qdm2.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libavformat/rtpdec_qdm2.c b/libavformat/rtpdec_qdm2.c index 1eec2da5b4..729a1ff892 100644 --- a/libavformat/rtpdec_qdm2.c +++ b/libavformat/rtpdec_qdm2.c @@ -187,8 +187,9 @@ static int qdm2_parse_subpacket(PayloadContext *qdm, AVStream *st, */ static int qdm2_restore_block(PayloadContext *qdm, AVStream *st, AVPacket *pkt) { - int to_copy, n, res, include_csum; + int to_copy, n, res; uint8_t *p, *csum_pos = NULL; + int include_csum = qdm->block_type == 2 || qdm->block_type == 4; /* create packet to hold subpkts into a superblock */ av_assert0(qdm->cache > 0); @@ -197,6 +198,11 @@ static int qdm2_restore_block(PayloadContext *qdm, AVStream *st, AVPacket *pkt) break; av_assert0(n < 0x80); + int min_size = 2 + (qdm->len[n] > 0xff) + 2*include_csum; + + if (qdm->block_size < min_size) + return AVERROR_INVALIDDATA; + if ((res = av_new_packet(pkt, qdm->block_size)) < 0) return res; memset(pkt->data, 0, pkt->size); @@ -212,7 +218,7 @@ static int qdm2_restore_block(PayloadContext *qdm, AVStream *st, AVPacket *pkt) *p++ = qdm->block_type; *p++ = qdm->len[n]; } - if ((include_csum = (qdm->block_type == 2 || qdm->block_type == 4))) { + if (include_csum) { csum_pos = p; p += 2; } _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
