This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.1 in repository ffmpeg.
commit b305f8cdc9deffd8f1995b262c60e2a907226018 Author: zhorzhetta1404-ux <[email protected]> AuthorDate: Mon Aug 17 13:07:08 2026 +0300 Commit: Michael Niedermayer <[email protected]> CommitDate: Sat Sep 19 14:27:17 2026 +0200 avformat/oggdec: check for integer overflow in buf_realloc In buf_realloc, os->bufsize is unsigned int and the code doubles it: nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE); When os->bufsize exceeds UINT_MAX/2, the multiplication overflows to a small value, av_realloc returns a tiny buffer, and the subsequent page write in ogg_read_page goes out of bounds. Reject the reallocation before the overflow can occur. The largest safe value is (UINT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 2. Signed-off-by: age5000 <[email protected]> (cherry picked from commit d7d119bbe26c7e5c27a8b50fc8a25da43564c48a) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/oggdec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c index a7b23c8d65..644c70e13f 100644 --- a/libavformat/oggdec.c +++ b/libavformat/oggdec.c @@ -305,7 +305,10 @@ static int buf_realloc(struct ogg_stream *os, int size) { /* Even if invalid guarantee there's enough memory to read the page */ if (os->bufsize - os->bufpos < size) { - uint8_t *nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE); + uint8_t *nb; + if (os->bufsize > (UINT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 2) + return AVERROR(ENOMEM); + nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE); if (!nb) return AVERROR(ENOMEM); os->buf = nb; -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
