PR #24089 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089.patch
librist_read() ignored its size argument and copied the full payload_len, overflowing a smaller destination (e.g. via the async: wrapper). Clamp the copy to the caller-provided buffer size. Fixes: out of array access >From 74a0252cbaf45bb765532e615fb0f2de6d6c1c6a Mon Sep 17 00:00:00 2001 From: Joshua Rogers <[email protected]> Date: Tue, 4 Aug 2026 12:11:55 +0000 Subject: [PATCH] avformat/librist: honor the caller buffer size in librist_read librist_read() ignored its size argument and copied the full payload_len, overflowing a smaller destination (e.g. via the async: wrapper). Clamp the copy to the caller-provided buffer size. Fixes: out of array access --- libavformat/librist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/librist.c b/libavformat/librist.c index 9669d5b5df..3c4b5e3e5b 100644 --- a/libavformat/librist.c +++ b/libavformat/librist.c @@ -226,7 +226,7 @@ static int librist_read(URLContext *h, uint8_t *buf, int size) } } - size = data_block->payload_len; + size = FFMIN(data_block->payload_len, size); memcpy(buf, data_block->payload, size); out_free: rist_receiver_data_block_free2(&data_block); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
