PR #24763 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24763 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24763.patch
Fixes: information leak of heap pointers and decoder state into the output Fixes: qhg9vxxyEOy1 Found-by: Yuyao Jiang Replicated through Modified FFmpeg >From 19961fc8823294918a5019868362b4ae4691d025 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 29 Sep 2026 01:57:32 +0200 Subject: [PATCH] avcodec/cook: reject js_subband_start beyond subbands Fixes: information leak of heap pointers and decoder state into the output Fixes: qhg9vxxyEOy1 Found-by: Yuyao Jiang Replicated through Modified FFmpeg --- libavcodec/cook.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavcodec/cook.c b/libavcodec/cook.c index 5ed3d2596b..71c2409ad3 100644 --- a/libavcodec/cook.c +++ b/libavcodec/cook.c @@ -1218,6 +1218,13 @@ static av_cold int cook_decode_init(AVCodecContext *avctx) return AVERROR_PATCHWELCOME; } + if (q->subpacket[s].joint_stereo && + q->subpacket[s].js_subband_start > q->subpacket[s].subbands) { + av_log(avctx, AV_LOG_ERROR, "js_subband_start %d > subbands %d\n", + q->subpacket[s].js_subband_start, q->subpacket[s].subbands); + return AVERROR_INVALIDDATA; + } + if ((q->subpacket[s].js_vlc_bits > 6) || (q->subpacket[s].js_vlc_bits < 2 * q->subpacket[s].joint_stereo)) { av_log(avctx, AV_LOG_ERROR, "js_vlc_bits = %d, only >= %d and <= 6 allowed!\n", -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
