PR #20894 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20894 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20894.patch
No testcase, its unknown if this is a real issue Reported-by: Peter Teoh <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> >From 67eea3903e440bf11666662423be651654bc0275 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 12 Nov 2025 03:05:15 +0100 Subject: [PATCH] avcodec/omx: Check extradata size and nFilledLen No testcase, its unknown if this is a real issue Reported-by: Peter Teoh <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/omx.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/omx.c b/libavcodec/omx.c index 6b900d741d..7b003ac1b7 100644 --- a/libavcodec/omx.c +++ b/libavcodec/omx.c @@ -688,6 +688,11 @@ static av_cold int omx_encode_init(AVCodecContext *avctx) buffer = get_buffer(&s->output_mutex, &s->output_cond, &s->num_done_out_buffers, s->done_out_buffers, 1); if (buffer->nFlags & OMX_BUFFERFLAG_CODECCONFIG) { + if (buffer->nFilledLen > INT32_MAX - AV_INPUT_BUFFER_PADDING_SIZE - avctx->extradata_size) { + ret = AVERROR(ENOMEM); + goto fail; + } + if ((ret = av_reallocp(&avctx->extradata, avctx->extradata_size + buffer->nFilledLen + AV_INPUT_BUFFER_PADDING_SIZE)) < 0) { avctx->extradata_size = 0; goto fail; -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
