This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 16daadeabbced8fc2aa467531d654bd3b0ad47bc Author: zhorzhetta1404-ux <[email protected]> AuthorDate: Mon Aug 17 13:07:08 2026 +0300 Commit: Michael Niedermayer <[email protected]> CommitDate: Thu Sep 17 02:34:29 2026 +0200 avformat/oggdec: check for integer overflow in buf_realloc In buf_realloc, os->bufsize is unsigned int and the code doubles it: nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE); When os->bufsize exceeds UINT_MAX/2, the multiplication overflows to a small value, av_realloc returns a tiny buffer, and the subsequent page write in ogg_read_page goes out of bounds. Reject the reallocation before the overflow can occur. The largest safe value is (UINT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 2. Signed-off-by: age5000 <[email protected]> (cherry picked from commit d7d119bbe26c7e5c27a8b50fc8a25da43564c48a) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/oggdec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c index 48279f2928..2192ea5874 100644 --- a/libavformat/oggdec.c +++ b/libavformat/oggdec.c @@ -304,7 +304,10 @@ static int buf_realloc(struct ogg_stream *os, int size) { /* Even if invalid guarantee there's enough memory to read the page */ if (os->bufsize - os->bufpos < size) { - uint8_t *nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE); + uint8_t *nb; + if (os->bufsize > (UINT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 2) + return AVERROR(ENOMEM); + nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE); if (!nb) return AVERROR(ENOMEM); os->buf = nb; -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
