This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit d11fcddf175ae8e7d69fd3ef3504a104f6545087 Author: Rainbaby <[email protected]> AuthorDate: Fri Aug 28 16:18:08 2026 +0900 Commit: Peter Ross <[email protected]> CommitDate: Mon Nov 2 22:18:06 2026 +0000 avcodec/cavsdec: reject the error returns of get_ue_golomb() get_ue_golomb() returns AVERROR_INVALIDDATA on thirteen or more leading zero bits. Two callers used the value unchecked: mb_type reached decode_mb_p() with a value no case of its switch covers, leaving ff_cavs_inter() and ff_cavs_filter() to index ff_cavs_partition_flags[] with it, and mb_skip_run was decremented from negative. decode_mb_b() already rejects the first, so do it the same way. Only the unsigned underlying type of enum cavs_mb hid the first under gcc and clang; that is a compiler's choice, not a guarantee. Signed-off-by: Rainbaby <[email protected]> --- libavcodec/cavsdec.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c index cd35491192..2e503a77aa 100644 --- a/libavcodec/cavsdec.c +++ b/libavcodec/cavsdec.c @@ -780,6 +780,11 @@ static int decode_mb_p(AVSContext *h, enum cavs_mb mb_type) ff_cavs_mv(h, MV_FWD_X1, MV_FWD_C2, MV_PRED_MEDIAN, BLK_8X8, ref[1]); ff_cavs_mv(h, MV_FWD_X2, MV_FWD_X1, MV_PRED_MEDIAN, BLK_8X8, ref[2]); ff_cavs_mv(h, MV_FWD_X3, MV_FWD_X0, MV_PRED_MEDIAN, BLK_8X8, ref[3]); + break; + default: + av_log(h->avctx, AV_LOG_ERROR, "Invalid mb_type %d in P frame\n", + mb_type); + return AVERROR_INVALIDDATA; } ff_cavs_inter(h, mb_type); set_intra_mode_default(h); @@ -1162,6 +1167,10 @@ static int decode_pic(AVSContext *h) break; } skip_count = get_ue_golomb(&h->gb); + if (skip_count < 0) { + ret = AVERROR_INVALIDDATA; + break; + } } if (h->skip_mode_flag && skip_count--) { ret = decode_mb_p(h, P_SKIP); @@ -1199,6 +1208,10 @@ static int decode_pic(AVSContext *h) break; } skip_count = get_ue_golomb(&h->gb); + if (skip_count < 0) { + ret = AVERROR_INVALIDDATA; + break; + } } if (h->skip_mode_flag && skip_count--) { ret = decode_mb_b(h, B_SKIP); -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
