max/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/on2avc: reject subframe count whose * SUBFRAME_SIZE product overflows 32-bit

Browse Source 
Found-by: Anthropic agents; validated and reported by Ada Logics.
Signed-off-by: David Korczynski <david@adalogics.com>
This commit is contained in:
David Korczynski
2026-06-05 00:14:06 +02:00
committed by michaelni
parent 2576e09434
commit 331b3e9dea
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/on2avc.c
+6
View File
@@ -866,6 +866,12 @@ static int on2avc_decode_frame(AVCodecContext * avctx, AVFrame *frame,
av_log(avctx, AV_LOG_ERROR, "No subframes present\n"); av_log(avctx, AV_LOG_ERROR, "No subframes present\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
if (num_frames > INT_MAX / ON2AVC_SUBFRAME_SIZE) {
av_log(avctx, AV_LOG_ERROR,
"Too many subframes (%d); per-frame sample count overflows\n",
num_frames);
return AVERROR_INVALIDDATA;
}
/* get output buffer */ /* get output buffer */
frame->nb_samples = ON2AVC_SUBFRAME_SIZE * num_frames; frame->nb_samples = ON2AVC_SUBFRAME_SIZE * num_frames;