PR #25079 opened by romainhedouin URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25079 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25079.patch
diff_size is read with bytestream_get_be32() but was stored in a uint16_t, so sizes of 64 KiB or more were truncated and the parser advanced by the wrong amount Tested: make fate passes Signed-off-by: romainhedouin <[email protected]> <!-- If this PR requires new FATE test samples, attach them to the PR and list their target paths below (relative to the fate-suite root). Attached filenames must match the sample's filename: ```fate-samples # e.g. vorbis/new-sample.ogg ``` --> >From cbce07430616339ae199801c735cb98e0849d25a Mon Sep 17 00:00:00 2001 From: romainhedouin <[email protected]> Date: Wed, 14 Oct 2026 21:07:20 +0200 Subject: [PATCH] avcodec/cdtoons: use a 32-bit type for the Diff entry size diff_size is read with bytestream_get_be32() but was stored in a uint16_t, so sizes of 64 KiB or more were truncated and the parser advanced by the wrong amount. Tested: make fate passes (there is no cdtoons sample in FATE). Found with the help of an AI code review; verified by hand. Signed-off-by: romainhedouin <[email protected]> --- libavcodec/cdtoons.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cdtoons.c b/libavcodec/cdtoons.c index f96c89115b..b3a4ba8371 100644 --- a/libavcodec/cdtoons.c +++ b/libavcodec/cdtoons.c @@ -261,7 +261,7 @@ static int cdtoons_decode_frame(AVCodecContext *avctx, AVFrame *rframe, buf += 8; /* clip rect? */ for (int i = 0; i < diff_count; i++) { int16_t top, left; - uint16_t diff_size, width, height; + uint32_t diff_size, width, height; if (buf + 16 > eod) { av_log(avctx, AV_LOG_WARNING, "Ran (seriously) out of data for Diff frame header.\n"); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
