This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit b89ce54d93bf644433dfa9fbc34f19c22237691a Author: Joshua Rogers <[email protected]> AuthorDate: Sun Oct 18 05:37:11 2026 +0200 Commit: michaelni <[email protected]> CommitDate: Sun Oct 25 02:45:48 2026 +0000 avcodec/cbs_jpeg: check the scan data size without overflowing size_t Fixes: xf78sw1plZNy Fixes: AISLE-2026-0150-00556 Fixes: out of array write Out of array write Replicated through UnModified FFmpeg with ASAN Found-by: Joshua Rogers (AISLE) The check is the one given in the report's recommendation; analysis, testcase and verification by Michael Niedermayer. --- libavcodec/cbs_jpeg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cbs_jpeg.c b/libavcodec/cbs_jpeg.c index e1631a4246..577757dbea 100644 --- a/libavcodec/cbs_jpeg.c +++ b/libavcodec/cbs_jpeg.c @@ -296,7 +296,7 @@ static int cbs_jpeg_write_scan(CodedBitstreamContext *ctx, return err; if (scan->data) { - if (scan->data_size * 8 > put_bits_left(pbc)) + if (scan->data_size > put_bits_left(pbc) / 8) return AVERROR(ENOSPC); av_assert0(put_bits_count(pbc) % 8 == 0); -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
