This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 331b3e9dea avcodec/on2avc: reject subframe count whose * SUBFRAME_SIZE
product overflows 32-bit
331b3e9dea is described below
commit 331b3e9dea484f4974bbff2596e6e31c3d5e4685
Author: David Korczynski <[email protected]>
AuthorDate: Fri Jun 5 00:14:06 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Wed Jun 10 02:15:53 2026 +0000
avcodec/on2avc: reject subframe count whose * SUBFRAME_SIZE product
overflows 32-bit
Found-by: Anthropic agents; validated and reported by Ada Logics.
Signed-off-by: David Korczynski <[email protected]>
---
libavcodec/on2avc.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavcodec/on2avc.c b/libavcodec/on2avc.c
index 0a912cc30b..41ada55e1a 100644
--- a/libavcodec/on2avc.c
+++ b/libavcodec/on2avc.c
@@ -866,6 +866,12 @@ static int on2avc_decode_frame(AVCodecContext * avctx,
AVFrame *frame,
av_log(avctx, AV_LOG_ERROR, "No subframes present\n");
return AVERROR_INVALIDDATA;
}
+ if (num_frames > INT_MAX / ON2AVC_SUBFRAME_SIZE) {
+ av_log(avctx, AV_LOG_ERROR,
+ "Too many subframes (%d); per-frame sample count
overflows\n",
+ num_frames);
+ return AVERROR_INVALIDDATA;
+ }
/* get output buffer */
frame->nb_samples = ON2AVC_SUBFRAME_SIZE * num_frames;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
