This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 9c2aabaa34147b7a3812e5857bcb4f9f6e17a5f7 Author: Michael Niedermayer <[email protected]> AuthorDate: Sat Jul 11 16:46:17 2026 +0200 Commit: michaelni <[email protected]> CommitDate: Mon Jul 13 01:08:09 2026 +0000 avcodec/cavsdec: reject invalid start-code bitreader sizes Fixes: NULL pointer dereference Fixes: 4jy_poc_cavs.zip / poc_cavs.avi Fixes: UH66Y8Om9F8X Found-by: Jiale Yao <[email protected]> --- libavcodec/cavsdec.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c index bc1ed60bf0..b6dd5f2d3f 100644 --- a/libavcodec/cavsdec.c +++ b/libavcodec/cavsdec.c @@ -1266,10 +1266,11 @@ static int cavs_decode_frame(AVCodecContext *avctx, AVFrame *rframe, av_log(h->avctx, AV_LOG_WARNING, "no frame decoded\n"); return FFMAX(0, buf_ptr - buf); } - input_size = (buf_end - buf_ptr) * 8; + input_size = buf_end - buf_ptr; + if ((ret = init_get_bits8(&h->gb, buf_ptr, input_size)) < 0) + return ret; switch (stc) { case CAVS_START_CODE: - init_get_bits(&h->gb, buf_ptr, input_size); decode_seq_header(h); break; case PIC_I_START_CODE: @@ -1288,7 +1289,6 @@ static int cavs_decode_frame(AVCodecContext *avctx, AVFrame *rframe, *got_frame = 0; if (!h->got_keyframe) break; - init_get_bits(&h->gb, buf_ptr, input_size); h->stc = stc; if (decode_pic(h)) break; @@ -1312,7 +1312,6 @@ static int cavs_decode_frame(AVCodecContext *avctx, AVFrame *rframe, break; default: if (stc <= SLICE_MAX_START_CODE) { - init_get_bits(&h->gb, buf_ptr, input_size); decode_slice_header(h, &h->gb); } break; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
