PR #20245 opened by Marvin Scholz (ePirat) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20245 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20245.patch
When dimensions differ from context, those were updated using ff_set_dimensions, however this overwrote the aligned coded_width and coded_height that were set before, leading to a buffer overflow when writing the frame data. Fixes: OssFuzz 438771336 Fixes: Heap-buffer-overflow Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Marvin Scholz <epira...@gmail.com> Reviewed-by: Marvin Scholz <epira...@gmail.com> >From 9a6fc04013e0913830e9f1cf513977cfe10f49d7 Mon Sep 17 00:00:00 2001 From: Oliver Chang <och...@google.com> Date: Thu, 14 Aug 2025 22:11:41 -0700 Subject: [PATCH] avcodec/prores_raw: Fix heap buffer overflow When dimensions differ from context, those were updated using ff_set_dimensions, however this overwrote the aligned coded_width and coded_height that were set before, leading to a buffer overflow when writing the frame data. Fixes: OssFuzz 438771336 Fixes: Heap-buffer-overflow Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Marvin Scholz <epira...@gmail.com> Reviewed-by: Marvin Scholz <epira...@gmail.com> --- libavcodec/prores_raw.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/prores_raw.c b/libavcodec/prores_raw.c index 748e176815..b2aa97ddda 100644 --- a/libavcodec/prores_raw.c +++ b/libavcodec/prores_raw.c @@ -367,9 +367,6 @@ static int decode_frame(AVCodecContext *avctx, if ((w & 1) || (h & 1)) return AVERROR_INVALIDDATA; - avctx->coded_width = FFALIGN(w, 16); - avctx->coded_height = FFALIGN(h, 16); - if (w != avctx->width || h != avctx->height) { av_log(avctx, AV_LOG_WARNING, "picture resolution change: %ix%i -> %ix%i\n", avctx->width, avctx->height, w, h); @@ -377,6 +374,9 @@ static int decode_frame(AVCodecContext *avctx, return ret; } + avctx->coded_width = FFALIGN(w, 16); + avctx->coded_height = FFALIGN(h, 16); + enum AVPixelFormat pix_fmt = AV_PIX_FMT_BAYER_RGGB16; if (pix_fmt != s->pix_fmt) { s->pix_fmt = pix_fmt; -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
