This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit f02f1707b1318fd8cdf2b2936ce79d0061cdad08 Author: zhang xingxing <[email protected]> AuthorDate: Tue Oct 13 06:54:15 2026 +0200 Commit: michaelni <[email protected]> CommitDate: Tue Oct 20 11:36:57 2026 +0000 avcodec/dvbsubdec: check the object segment size before reading its header This is not a security issue. Fixes: hlm9X3ZdVjBu Fixes: swarm-Missing-buf_size-validation-in-dvbsub_parse_object_segment-a29b35 Found-by: zhang xingxing <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/dvbsubdec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/dvbsubdec.c b/libavcodec/dvbsubdec.c index 7608a44423..0256e8355d 100644 --- a/libavcodec/dvbsubdec.c +++ b/libavcodec/dvbsubdec.c @@ -999,6 +999,9 @@ static int dvbsub_parse_object_segment(AVCodecContext *avctx, int coding_method, non_modifying_color; + if (buf_size < 3) + return AVERROR_INVALIDDATA; + object_id = AV_RB16(buf); buf += 2; @@ -1011,6 +1014,8 @@ static int dvbsub_parse_object_segment(AVCodecContext *avctx, non_modifying_color = ((*buf++) >> 1) & 1; if (coding_method == 0) { + if (buf_end - buf < 4) + return AVERROR_INVALIDDATA; top_field_len = AV_RB16(buf); buf += 2; bottom_field_len = AV_RB16(buf); -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
