This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit ad25ca73b56cf5b2933fb2d38902dfa5913104ec Author: Michael Niedermayer <[email protected]> AuthorDate: Sat Jul 11 17:01:30 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Aug 2 02:47:31 2026 +0200 avcodec/dovi_rpudec: bound num_x/y_partitions Fixes: out of array access Fixes: SUcVEyk7r3Gc Found-by: Kenan Alghythee <[email protected]> (cherry picked from commit 79e10e51960f848b82c597c540087bcc66aa6e17) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/dovi_rpudec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/dovi_rpudec.c b/libavcodec/dovi_rpudec.c index d210ba52cf..ba4e7cd214 100644 --- a/libavcodec/dovi_rpudec.c +++ b/libavcodec/dovi_rpudec.c @@ -582,6 +582,8 @@ int ff_dovi_rpu_parse(DOVIContext *s, const uint8_t *rpu, size_t rpu_size, mapping->num_x_partitions = get_ue_golomb_long(gb) + 1; mapping->num_y_partitions = get_ue_golomb_long(gb) + 1; + VALIDATE(mapping->num_x_partitions, 1, 0xFFFF); + VALIDATE(mapping->num_y_partitions, 1, 0xFFFF); /* End of rpu_data_header(), start of vdr_rpu_data_payload() */ for (int c = 0; c < 3; c++) { _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
