max/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/spdifenc: bound DTS core_size against the packet size in the HD path

Browse Source 
Fixes: out of array read
Fixes: yBSax492UIB9
Fixes: 482d98f69b (spdifenc: IEC 61937 encapsulation of DTS-HD for HDMI)
Found-by: Pavel Kohout (Aisle Research)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-06-30 00:11:50 +02:00
committed by michaelni
parent 95a888b9ca
commit 6f80e27654
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavformat/spdifenc.c
+1 -1
View File
@@ -225,7 +225,7 @@ static int spdif_header_dts4(AVFormatContext *s, AVPacket *pkt, int core_size,
* (dtshd_fallback == 0) */
ctx->dtshd_skip = 1;
}
if (ctx->dtshd_skip && core_size) {
if (ctx->dtshd_skip && core_size && core_size <= pkt->size) {
pkt_size = core_size;
if (ctx->dtshd_fallback >= 0)
--ctx->dtshd_skip;