This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 16b2049d4d5222db6cd7c031409058571c94f6a9 Author: Michael Niedermayer <[email protected]> AuthorDate: Wed Jul 22 05:53:16 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Aug 2 02:47:32 2026 +0200 avcodec/cfhd: reject transform-2 output wider than the plane Fixes: out of array access Fixes: cfhd_transform2_output_width_oob.avi Fixes: MimvoaEVpKow Found-by: Adrian Junge (vurlo) (cherry picked from commit db05df9d135fb56a4babb836d5e9f5c1d984e087) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/cfhd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c index 4d430e32ef..128362ac62 100644 --- a/libavcodec/cfhd.c +++ b/libavcodec/cfhd.c @@ -1224,7 +1224,7 @@ finish: if (lowpass_height > s->plane[plane].band[4][1].a_height || lowpass_width > s->plane[plane].band[4][1].a_width || !highpass_stride || s->plane[plane].band[4][1].width > s->plane[plane].band[4][1].a_width || - lowpass_width < 3 || lowpass_height < 3) { + lowpass_width < 3 || lowpass_height < 3 || lowpass_width * 2 > s->plane[plane].width) { av_log(avctx, AV_LOG_ERROR, "Invalid plane dimensions\n"); ret = AVERROR(EINVAL); goto end; @@ -1345,7 +1345,7 @@ finish: if (lowpass_height > s->plane[plane].band[4][1].a_height || lowpass_width > s->plane[plane].band[4][1].a_width || s->plane[plane].band[4][1].width > s->plane[plane].band[4][1].a_width || - lowpass_width < 3 || lowpass_height < 3) { + lowpass_width < 3 || lowpass_height < 3 || lowpass_width * 2 > s->plane[plane].width) { av_log(avctx, AV_LOG_ERROR, "Invalid plane dimensions\n"); ret = AVERROR(EINVAL); goto end; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
