This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 5d59b7c45d7142bddd13ddc8891e72c5c7dc991b Author: zhang xingxing <[email protected]> AuthorDate: Tue Oct 13 06:52:48 2026 +0200 Commit: michaelni <[email protected]> CommitDate: Tue Oct 20 11:36:57 2026 +0000 avcodec/mpc7: reject a last frame length larger than a frame Fixes: out of array read Fixes: dcrkQkffMQ8b Fixes: swarm-Missing-bounds-check-on-last-frame-length-enables-heap-OOB-read-e00668 Found-by: zhang xingxing <[email protected]> Out of array read Replicated through UnModified FFmpeg with ASAN Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/mpc7.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/mpc7.c b/libavcodec/mpc7.c index b95cec1f0f..1824c7e98b 100644 --- a/libavcodec/mpc7.c +++ b/libavcodec/mpc7.c @@ -109,6 +109,10 @@ static av_cold int mpc7_decode_init(AVCodecContext * avctx) skip_bits_long(&gb, 88); c->gapless = get_bits1(&gb); c->lastframelen = get_bits(&gb, 11); + if (c->lastframelen > MPC_FRAME_SIZE) { + av_log(avctx, AV_LOG_ERROR, "Invalid last frame length: %d\n", c->lastframelen); + return AVERROR_INVALIDDATA; + } av_log(avctx, AV_LOG_DEBUG, "IS: %d, MSS: %d, TG: %d, LFL: %d, bands: %d\n", c->IS, c->MSS, c->gapless, c->lastframelen, c->maxbands); c->frames_to_skip = 0; -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
