PR #23631 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631.patch
Fixes: heap buffer overflow Fixes: FmXBI2dbgvgD Fixes: 0eea212943544d40f99b05571aa7159d78667154 (Add avcodec_decode_audio4().) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <[email protected]> >From 0e1e457a7e675e06d82a36a61f7b6adfeef469a2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 29 Jun 2026 01:16:44 +0200 Subject: [PATCH] avcodec/mace: reject sample counts that overflow int Fixes: heap buffer overflow Fixes: FmXBI2dbgvgD Fixes: 0eea212943544d40f99b05571aa7159d78667154 (Add avcodec_decode_audio4().) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/mace.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/mace.c b/libavcodec/mace.c index 299e5f5cfe..87e802684a 100644 --- a/libavcodec/mace.c +++ b/libavcodec/mace.c @@ -252,7 +252,10 @@ static int mace_decode_frame(AVCodecContext *avctx, AVFrame *frame, } /* get output buffer */ - frame->nb_samples = 3 * (buf_size << (1 - is_mace3)) / channels; + int64_t nb_samples = 3 * ((int64_t)buf_size << (1 - is_mace3)) / channels; + if (nb_samples > INT_MAX) + return AVERROR_INVALIDDATA; + frame->nb_samples = nb_samples; if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) return ret; samples = (int16_t **)frame->extended_data; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
