PR #24507 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24507 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24507.patch
Fixes: NULL pointer dereference Fixes: signed integer overflow Fixes: s6y285XTJaIu Found-by: Zheng Yu @ Depthfirst >From 403bf20fcf79647ac0631afc19f8cbebed693bbd Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 15 Sep 2026 06:13:53 +0200 Subject: [PATCH] avcodec/diracdec: fail on a data unit whose size does not fit the bit reader Fixes: NULL pointer dereference Fixes: signed integer overflow Fixes: s6y285XTJaIu Found-by: Zheng Yu @ Depthfirst --- libavcodec/diracdec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c index 4f2ddb5897..aa54dbaff2 100644 --- a/libavcodec/diracdec.c +++ b/libavcodec/diracdec.c @@ -2133,7 +2133,9 @@ static int dirac_decode_data_unit(AVCodecContext *avctx, const uint8_t *buf, int parse_code = buf[4]; - init_get_bits(&s->gb, &buf[13], 8*(size - DATA_UNIT_HEADER_SIZE)); + ret = init_get_bits8(&s->gb, &buf[13], size - DATA_UNIT_HEADER_SIZE); + if (ret < 0) + return ret; if (parse_code == DIRAC_PCODE_SEQ_HEADER) { if (s->seen_sequence_header) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
