This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 5c0b32e0ae5134864e0cbd4236d17e91fa10c445 Author: zhang xingxing <[email protected]> AuthorDate: Thu Oct 15 04:35:44 2026 +0200 Commit: michaelni <[email protected]> CommitDate: Mon Oct 19 23:51:00 2026 +0000 avcodec/tiff_common: do not size the metadata bprint from count Fixes: 0gCI9NJKm3tO Fixes: swarm-Signed-overflow-of-10-count-100-count-in-av_bprint_init-f6bdbe Regression since: b7ba7cbd6e Signed integer overflow Replicated through UnModified FFmpeg with UBSAN Found-by: zhang xingxing <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/tiff_common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/tiff_common.c b/libavcodec/tiff_common.c index 265f843031..c4c672632a 100644 --- a/libavcodec/tiff_common.c +++ b/libavcodec/tiff_common.c @@ -108,7 +108,7 @@ int ff_tadd_doubles_metadata(int count, const char *name, const char *sep, if (bytestream2_get_bytes_left(gb) < count * sizeof(int64_t)) return AVERROR_INVALIDDATA; - av_bprint_init(&bp, 10 * count, 100 * count); + av_bprint_init(&bp, 0, AV_BPRINT_SIZE_UNLIMITED); for (i = 0; i < count; i++) { av_bprintf(&bp, "%s%.15g", auto_sep(count, sep, i, 4), ff_tget_double(gb, le)); @@ -129,7 +129,7 @@ int ff_tadd_shorts_metadata(int count, const char *name, const char *sep, if (bytestream2_get_bytes_left(gb) < count * sizeof(int16_t)) return AVERROR_INVALIDDATA; - av_bprint_init(&bp, 10 * count, AV_BPRINT_SIZE_UNLIMITED); + av_bprint_init(&bp, 0, AV_BPRINT_SIZE_UNLIMITED); for (i = 0; i < count; i++) { int v = is_signed ? (int16_t)ff_tget_short(gb, le) : ff_tget_short(gb, le); -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
