PR #23379 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23379 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23379.patch
Found-by: Anthropic agents; validated and reported by Ada Logics. Signed-off-by: David Korczynski <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> >From d6767a822df6143cae4f5ece1cae7ea2f56f9aa0 Mon Sep 17 00:00:00 2001 From: David Korczynski <[email protected]> Date: Sat, 6 Jun 2026 16:23:27 +0200 Subject: [PATCH] avcodec/truespeech: reject iterations count whose * 240 product overflows 32-bit Found-by: Anthropic agents; validated and reported by Ada Logics. Signed-off-by: David Korczynski <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/truespeech.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/truespeech.c b/libavcodec/truespeech.c index 454121cc75..1c1b4057a2 100644 --- a/libavcodec/truespeech.c +++ b/libavcodec/truespeech.c @@ -323,6 +323,11 @@ static int truespeech_decode_frame(AVCodecContext *avctx, AVFrame *frame, "Too small input buffer (%d bytes), need at least 32 bytes\n", buf_size); return -1; } + if (iterations > INT_MAX / 240) { + av_log(avctx, AV_LOG_ERROR, + "Too large input buffer (%d bytes); per-block sample count overflows\n", buf_size); + return AVERROR_INVALIDDATA; + } /* get output buffer */ frame->nb_samples = iterations * 240; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
