This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.0 in repository ffmpeg.
commit 9094f760e6197e75c97b5b43e12a086b147a27d5 Author: David Korczynski <[email protected]> AuthorDate: Thu May 21 04:30:36 2026 -0700 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 14 04:59:05 2026 +0200 avcodec/cook: bound subpacket channel sum against channel count Fixes: out of array read Fixes: evil.rm Found-by: Anthropic agents; validated and reported by Ada Logics. Signed-off-by: David Korczynski <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 1152139b4898888f7ca3daa1caca715c87dc1e85) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/cook.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavcodec/cook.c b/libavcodec/cook.c index f627967ffb..75f8136f52 100644 --- a/libavcodec/cook.c +++ b/libavcodec/cook.c @@ -1080,6 +1080,7 @@ static av_cold int cook_decode_init(AVCodecContext *avctx) int s = 0; unsigned int channel_mask = 0; int samples_per_frame = 0; + int total_channels = 0; int ret; int channels = avctx->ch_layout.nb_channels; @@ -1237,10 +1238,12 @@ static av_cold int cook_decode_init(AVCodecContext *avctx) q->subpacket[s].gains2.now = q->subpacket[s].gain_3; q->subpacket[s].gains2.previous = q->subpacket[s].gain_4; - if (q->num_subpackets + q->subpacket[s].num_channels > channels) { - av_log(avctx, AV_LOG_ERROR, "Too many subpackets %d for channels %d\n", q->num_subpackets, channels); + if (total_channels + q->subpacket[s].num_channels > channels) { + av_log(avctx, AV_LOG_ERROR, "Too many subpacket channels %d for channels %d\n", + total_channels + q->subpacket[s].num_channels, channels); return AVERROR_INVALIDDATA; } + total_channels += q->subpacket[s].num_channels; q->num_subpackets++; s++; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
