This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/4.4 in repository ffmpeg.
commit fd12ac810150beba86eb27029f915dff5e0e0ace Author: Michael Niedermayer <[email protected]> AuthorDate: Sun Jun 21 17:53:08 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 21 17:59:33 2026 +0200 avformat/matroskadec: Check audio.sub_packet_h * audio.frame_size Reject block_align larger than the sub_packet_h * frame_size buffer to avoid a heap out-of-bounds write when deinterleaving RealAudio subpackets. (cherry picked from commit 20fc83fa5b... adapted to 4.4) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/matroskadec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index 0fcd950a9d..2da3f46541 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -2708,6 +2708,10 @@ static int matroska_parse_tracks(AVFormatContext *s) st->codecpar->block_align = track->audio.sub_packet_size; extradata_offset = 78; } + if (st->codecpar->block_align <= 0 || + track->audio.sub_packet_h * (unsigned)track->audio.frame_size > INT_MAX || + track->audio.frame_size * track->audio.sub_packet_h < st->codecpar->block_align) + return AVERROR_INVALIDDATA; track->audio.buf = av_malloc_array(track->audio.sub_packet_h, track->audio.frame_size); if (!track->audio.buf) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
