The branch, master has been updated
via c9e93df4eed93fe0044c52d953688c4180de1d48 (commit)
from ac5303a5b9cdc17e4ebddfdc3203a4c325d42c52 (commit)
- Log -----------------------------------------------------------------
commit c9e93df4eed93fe0044c52d953688c4180de1d48
Author: Oliver Chang <[email protected]>
AuthorDate: Thu Aug 14 22:11:41 2025 -0700
Commit: Lynne <[email protected]>
CommitDate: Fri Aug 15 15:06:58 2025 +0000
avcodec/prores_raw: Fix heap buffer overflow
When dimensions differ from context, those were updated using
ff_set_dimensions, however this overwrote the aligned coded_width and
coded_height that were set before, leading to a buffer overflow when
writing the frame data.
Fixes: OssFuzz 438771336
Fixes: Heap-buffer-overflow
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Marvin Scholz <[email protected]>
Reviewed-by: Marvin Scholz <[email protected]>
diff --git a/libavcodec/prores_raw.c b/libavcodec/prores_raw.c
index 748e176815..b2aa97ddda 100644
--- a/libavcodec/prores_raw.c
+++ b/libavcodec/prores_raw.c
@@ -367,9 +367,6 @@ static int decode_frame(AVCodecContext *avctx,
if ((w & 1) || (h & 1))
return AVERROR_INVALIDDATA;
- avctx->coded_width = FFALIGN(w, 16);
- avctx->coded_height = FFALIGN(h, 16);
-
if (w != avctx->width || h != avctx->height) {
av_log(avctx, AV_LOG_WARNING, "picture resolution change: %ix%i ->
%ix%i\n",
avctx->width, avctx->height, w, h);
@@ -377,6 +374,9 @@ static int decode_frame(AVCodecContext *avctx,
return ret;
}
+ avctx->coded_width = FFALIGN(w, 16);
+ avctx->coded_height = FFALIGN(h, 16);
+
enum AVPixelFormat pix_fmt = AV_PIX_FMT_BAYER_RGGB16;
if (pix_fmt != s->pix_fmt) {
s->pix_fmt = pix_fmt;
-----------------------------------------------------------------------
Summary of changes:
libavcodec/prores_raw.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
hooks/post-receive
--
_______________________________________________
ffmpeg-cvslog mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".
