This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/5.1 in repository ffmpeg.
commit 2c99cc2a2b010b82a37bc524d3049fda8b52fb4e Author: Michael Niedermayer <[email protected]> AuthorDate: Sun Jun 21 01:04:21 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 21 02:56:27 2026 +0200 avformat/matroskadec: Check audio.sub_packet_h * audio.frame_size Reject block_align larger than the sub_packet_h * frame_size buffer to avoid a heap out-of-bounds write when deinterleaving RealAudio subpackets. (cherry picked from commit 20fc83fa5b... adapted to 5.1 structure) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/matroskadec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index bb61042d28..127982ccd6 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -2796,6 +2796,10 @@ static int matroska_parse_tracks(AVFormatContext *s) st->codecpar->block_align = track->audio.sub_packet_size; extradata_offset = 78; } + if (st->codecpar->block_align <= 0 || + track->audio.sub_packet_h * (unsigned)track->audio.frame_size > INT_MAX || + track->audio.frame_size * track->audio.sub_packet_h < st->codecpar->block_align) + return AVERROR_INVALIDDATA; track->audio.buf = av_malloc_array(track->audio.sub_packet_h, track->audio.frame_size); if (!track->audio.buf) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
