This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 780f6efbcf6ea4f044055eec32d533eeaf0bc58c Author: Jun Zhao <[email protected]> AuthorDate: Fri Aug 28 07:44:27 2026 +0800 Commit: Jun Zhao <[email protected]> CommitDate: Tue Sep 8 05:00:37 2026 +0000 avformat/vpk: Check the channel count before dividing in the last block vpk_read_packet() divides last_block_size and block_align by codecpar->ch_layout.nb_channels when assembling the last interleaved block. Header parsing already rejects a non-positive channel count, but a failed avcodec_open2() can later zero the layout through ff_codec_close() -> av_opt_free(), so the division is reached with a zero divisor. Check the channel count again before dividing and return AVERROR_INVALIDDATA. Original-patch-by: Kacper Michajłow <[email protected]> Fixes: #24290 Reported-by: Darío Clavijo Found-by: OSS-Fuzz Signed-off-by: Jun Zhao <[email protected]> --- libavformat/vpk.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/libavformat/vpk.c b/libavformat/vpk.c index f6270a11ae..172e45d7da 100644 --- a/libavformat/vpk.c +++ b/libavformat/vpk.c @@ -87,9 +87,14 @@ static int vpk_read_packet(AVFormatContext *s, AVPacket *pkt) vpk->current_block++; if (vpk->current_block == vpk->block_count) { - unsigned size = vpk->last_block_size / par->ch_layout.nb_channels; - unsigned skip = (par->block_align - vpk->last_block_size) / par->ch_layout.nb_channels; - uint64_t pos = avio_tell(s->pb); + unsigned size, skip; + uint64_t pos; + + if (par->ch_layout.nb_channels <= 0) + return AVERROR_INVALIDDATA; + size = vpk->last_block_size / par->ch_layout.nb_channels; + skip = (par->block_align - vpk->last_block_size) / par->ch_layout.nb_channels; + pos = avio_tell(s->pb); ret = av_new_packet(pkt, vpk->last_block_size); if (ret < 0) -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
