PR #23257 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23257 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23257.patch
Fixes: out of array read Fixes: evil.rm Found-by: Anthropic agents; validated and reported by Ada Logics. Signed-off-by: David Korczynski <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> >From d39218ba40c84d7c36f6cec37c4a305a7d92960e Mon Sep 17 00:00:00 2001 From: David Korczynski <[email protected]> Date: Thu, 21 May 2026 04:30:36 -0700 Subject: [PATCH] avcodec/cook: bound subpacket channel sum against channel count Fixes: out of array read Fixes: evil.rm Found-by: Anthropic agents; validated and reported by Ada Logics. Signed-off-by: David Korczynski <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/cook.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavcodec/cook.c b/libavcodec/cook.c index cc6005d3ff..8256afc2e4 100644 --- a/libavcodec/cook.c +++ b/libavcodec/cook.c @@ -1080,6 +1080,7 @@ static av_cold int cook_decode_init(AVCodecContext *avctx) int s = 0; unsigned int channel_mask = 0; int samples_per_frame = 0; + int total_channels = 0; int ret; int channels = avctx->ch_layout.nb_channels; @@ -1237,10 +1238,12 @@ static av_cold int cook_decode_init(AVCodecContext *avctx) q->subpacket[s].gains2.now = q->subpacket[s].gain_3; q->subpacket[s].gains2.previous = q->subpacket[s].gain_4; - if (q->num_subpackets + q->subpacket[s].num_channels > channels) { - av_log(avctx, AV_LOG_ERROR, "Too many subpackets %d for channels %d\n", q->num_subpackets, channels); + if (total_channels + q->subpacket[s].num_channels > channels) { + av_log(avctx, AV_LOG_ERROR, "Too many subpacket channels %d for channels %d\n", + total_channels + q->subpacket[s].num_channels, channels); return AVERROR_INVALIDDATA; } + total_channels += q->subpacket[s].num_channels; q->num_subpackets++; s++; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
