This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 2864ce5e28e5627aa03aad645e25deaa98c39889 Author: Marco Reimann <[email protected]> AuthorDate: Tue Jun 23 04:14:59 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue Jul 21 22:59:48 2026 +0200 avcodec/nellymoserdec: Check block count to avoid integer overflow Fixes: out of array access Fixes: nelly.avi / gen_nelly_overflow.py Fixes: pgc86PfE7ZpA Fixes: 0eea21294354 (Add avcodec_decode_audio4().) Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit f9482e1d01d7ae9395194f3c84b1d67dfb65c645) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/nellymoserdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/nellymoserdec.c b/libavcodec/nellymoserdec.c index 36477173ff..7037d6b0ba 100644 --- a/libavcodec/nellymoserdec.c +++ b/libavcodec/nellymoserdec.c @@ -156,8 +156,8 @@ static int decode_tag(AVCodecContext *avctx, AVFrame *frame, blocks = buf_size / NELLY_BLOCK_LEN; - if (blocks <= 0) { - av_log(avctx, AV_LOG_ERROR, "Packet is too small\n"); + if (blocks <= 0 || blocks > INT_MAX / NELLY_SAMPLES) { + av_log(avctx, AV_LOG_ERROR, "Packet is too small or too large\n"); return AVERROR_INVALIDDATA; } _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
