PR #24694 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24694 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24694.patch
Fixes: heap-buffer-overflow (write) Fixes: K5p3oItPlfin Fixes: ANT-2026-JWL71YJC-poc.avi Found-by: Claude and Ada Logics >From 668f15c1f830910afbbe86d978100d4a78fe96bd Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 25 Sep 2026 04:16:19 +0200 Subject: [PATCH] avcodec/mpeg12dec: reject a picture in the extradata Fixes: heap-buffer-overflow (write) Fixes: K5p3oItPlfin Fixes: ANT-2026-JWL71YJC-poc.avi Found-by: Claude and Ada Logics --- libavcodec/mpeg12dec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/mpeg12dec.c b/libavcodec/mpeg12dec.c index bef003704a..e30fa843cc 100644 --- a/libavcodec/mpeg12dec.c +++ b/libavcodec/mpeg12dec.c @@ -2298,6 +2298,8 @@ static int decode_chunks(AVCodecContext *avctx, AVFrame *picture, av_log(avctx, AV_LOG_WARNING, "ignoring picture start code in AVmp extradata\n"); break; } + if (buf == avctx->extradata) + return AVERROR_INVALIDDATA; if (s2->width <= 0 || s2->height <= 0) { av_log(avctx, AV_LOG_ERROR, "Invalid frame dimensions %dx%d.\n", -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
