This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 0d98581473a53c812e0f50329721e8ef1459903b Author: tangsha <[email protected]> AuthorDate: Mon Aug 31 20:20:31 2026 +0800 Commit: Michael Niedermayer <[email protected]> CommitDate: Thu Sep 17 02:41:40 2026 +0200 avutil/encryption_info: reject init info with zero-sized key IDs av_encryption_init_info_alloc() only allocates key_ids when key_id_size is non-zero, but stores num_key_ids regardless. If num_key_ids is non-zero and key_id_size is 0, the returned object has a NULL key_ids array alongside a non-zero num_key_ids. av_encryption_init_info_free(), av_encryption_init_info_get_side_data() and av_encryption_init_info_add_side_data() then loop over num_key_ids and dereference key_ids[i], leading to a null pointer dereference. Reject the num_key_ids > 0 && key_id_size == 0 combination instead of returning an inconsistent object. Signed-off-by: tangsha <[email protected]> (cherry picked from commit 9fc8c785e2747c87121ec28f8f10ceab0562384b) Signed-off-by: Michael Niedermayer <[email protected]> --- libavutil/encryption_info.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavutil/encryption_info.c b/libavutil/encryption_info.c index e4ff015b37..a3eb955d2d 100644 --- a/libavutil/encryption_info.c +++ b/libavutil/encryption_info.c @@ -181,6 +181,9 @@ AVEncryptionInitInfo *av_encryption_init_info_alloc( AVEncryptionInitInfo *info; uint32_t i; + if (num_key_ids && !key_id_size) + return NULL; + info = av_mallocz(sizeof(*info)); if (!info) return NULL; -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
