This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 374b726ffa878ee1cadb987bd1e1e20cc7ed8845 Author: Ori Hollander <[email protected]> AuthorDate: Sat May 9 00:00:00 2026 +0000 Commit: michaelni <[email protected]> CommitDate: Mon May 25 02:05:30 2026 +0000 avcodec/magicyuv: reject slice_height misaligned with chroma vshift Fixes: poc_magicyuv.avi Fixes: out of array access Found-by: Ori Hollander of the JFrog Vulnerability Research team --- libavcodec/magicyuv.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavcodec/magicyuv.c b/libavcodec/magicyuv.c index 46d474a24b..ea8a4007b6 100644 --- a/libavcodec/magicyuv.c +++ b/libavcodec/magicyuv.c @@ -553,6 +553,13 @@ static int magy_decode_frame(AVCodecContext *avctx, AVFrame *p, "invalid slice height: %d\n", s->slice_height); return AVERROR_INVALIDDATA; } + if (s->vshift[1] && (s->slice_height & ((1 << s->vshift[1]) - 1))) { + av_log(avctx, AV_LOG_ERROR, + "slice_height %d is not aligned to chroma vertical " + "subsampling (must be a multiple of %d)\n", + s->slice_height, 1 << s->vshift[1]); + return AVERROR_INVALIDDATA; + } bytestream2_skipu(&gb, 4); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
