This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch release/9.0
in repository ffmpeg.

commit d32b387f2b0a484599d4587d651891f0c63c4238
Author:     Michael Niedermayer <[email protected]>
AuthorDate: Wed Jul 22 05:57:51 2026 +0200
Commit:     Michael Niedermayer <[email protected]>
CommitDate: Mon Aug 3 21:52:07 2026 +0200

    avformat/rawutils: reject raw RGB frames that do not fit an AVPacket
    
    Fixes: integer overflow
    Fixes: out of array access
    Fixes: payload.film
    Fixes: czK1F83k3zvT
    Found-by: Clouditera Security, Z.ai Security, NSFOCUS
    (cherry picked from commit d3ad8a7fee6a647c6362e4a105d949282d50a98f)
    Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavformat/rawutils.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/libavformat/rawutils.c b/libavformat/rawutils.c
index e44c946d47..bf5113555f 100644
--- a/libavformat/rawutils.c
+++ b/libavformat/rawutils.c
@@ -29,15 +29,21 @@ int ff_reshuffle_raw_rgb(AVFormatContext *s, AVPacket 
**ppkt, AVCodecParameters
     int ret;
     AVPacket *pkt = *ppkt;
     int64_t bpc = par->bits_per_coded_sample != 15 ? 
par->bits_per_coded_sample : 16;
-    int min_stride = (par->width * bpc + 7) >> 3;
-    int with_pal_size = min_stride * par->height + 1024;
-    int contains_pal = bpc == 8 && pkt->size == with_pal_size;
-    int size = contains_pal ? min_stride * par->height : pkt->size;
-    int stride = size / par->height;
-    int padding = expected_stride - FFMIN(expected_stride, stride);
-    int y;
+    int64_t min_stride = (par->width * bpc + 7) >> 3;
+    int with_pal_size, contains_pal, size, stride, padding, y;
     AVPacket *new_pkt;
 
+    if (par->height <= 0 || min_stride <= 0 || expected_stride <= 0 ||
+        min_stride      > (INT_MAX - 1024) / par->height ||
+        expected_stride > (INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 
par->height)
+        return AVERROR(EINVAL);
+
+    with_pal_size = min_stride * par->height + 1024;
+    contains_pal  = bpc == 8 && pkt->size == with_pal_size;
+    size          = contains_pal ? min_stride * par->height : pkt->size;
+    stride        = size / par->height;
+    padding       = expected_stride - FFMIN(expected_stride, stride);
+
     if (pkt->size == expected_stride * par->height)
         return 0;
     if (size != stride * par->height)

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to