This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 8de8405796df0c11c52772dd14bf6ed552d25c07 Author: Michael Niedermayer <[email protected]> AuthorDate: Wed Jul 1 06:18:07 2026 +0200 Commit: michaelni <[email protected]> CommitDate: Thu Jul 9 02:54:00 2026 +0000 avcodec/tdsc: reject out-of-frame cursor position Fixes: signed integer overflow Fixes: 519649309/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TDSC_fuzzer-6322382028734464 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg --- libavcodec/tdsc.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/libavcodec/tdsc.c b/libavcodec/tdsc.c index e8d37a4e3f..ca9dd0f0a6 100644 --- a/libavcodec/tdsc.c +++ b/libavcodec/tdsc.c @@ -146,8 +146,7 @@ static void tdsc_paint_cursor(AVCodecContext *avctx, uint8_t *dst, int stride) { TDSCContext *ctx = avctx->priv_data; const uint8_t *cursor = ctx->cursor; - int x = ctx->cursor_x - ctx->cursor_hot_x; - int y = ctx->cursor_y - ctx->cursor_hot_y; + int x, y; int w = ctx->cursor_w; int h = ctx->cursor_h; int i, j; @@ -155,6 +154,16 @@ static void tdsc_paint_cursor(AVCodecContext *avctx, uint8_t *dst, int stride) if (!ctx->cursor) return; + /* A cursor position outside the frame is invalid; skip drawing it. + * cursor_x/y come straight from the bitstream, so bound them before + * the (16 bit) hot spot shift to avoid overflowing the clip math. */ + if ((unsigned)ctx->cursor_x >= ctx->width || + (unsigned)ctx->cursor_y >= ctx->height) + return; + + x = ctx->cursor_x - ctx->cursor_hot_x; + y = ctx->cursor_y - ctx->cursor_hot_y; + if (x + w > ctx->width) w = ctx->width - x; if (y + h > ctx->height) @@ -201,12 +210,6 @@ static int tdsc_load_cursor(AVCodecContext *avctx) ctx->cursor_stride = FFALIGN(ctx->cursor_w, 32) * 4; cursor_fmt = bytestream2_get_le32(&ctx->gbc); - if (ctx->cursor_x >= avctx->width || ctx->cursor_y >= avctx->height) { - av_log(avctx, AV_LOG_ERROR, - "Invalid cursor position (%d.%d outside %dx%d).\n", - ctx->cursor_x, ctx->cursor_y, avctx->width, avctx->height); - return AVERROR_INVALIDDATA; - } if (ctx->cursor_w < 1 || ctx->cursor_w > 256 || ctx->cursor_h < 1 || ctx->cursor_h > 256) { av_log(avctx, AV_LOG_ERROR, _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
