PR #24494 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24494 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24494.patch
Fixes: out of array read Fixes: Qf1CTWcULyGL Found-by: zhang xingxing Signed-off-by: Michael Niedermayer <[email protected]> >From 96d4c9ffe64a696f6a68a685b2735580e5def2ff Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 15 Sep 2026 04:16:24 +0200 Subject: [PATCH 1/2] avcodec/v210dec: reject a custom_stride smaller than one row Fixes: out of array read Fixes: Qf1CTWcULyGL Found-by: zhang xingxing Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/v210dec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/v210dec.c b/libavcodec/v210dec.c index 8b370e5659..c4ca12c1f7 100644 --- a/libavcodec/v210dec.c +++ b/libavcodec/v210dec.c @@ -162,6 +162,11 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *pic, } } + if (stride > 0 && stride < v210_stride(avctx->width, 6)) { + av_log(avctx, AV_LOG_ERROR, "custom_stride %d is smaller than one row\n", stride); + return AVERROR_INVALIDDATA; + } + if (stride == 0 && ((avctx->width & 1) || (int64_t)avctx->width * avctx->height > INT_MAX / 6)) { av_log(avctx, AV_LOG_ERROR, "Strideless v210 is not supported for size %dx%d\n", avctx->width, avctx->height); return AVERROR_INVALIDDATA; -- 2.52.0 >From fe096577143195d4661582c99beb1cb665f95656 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 14 Sep 2026 19:01:00 +0200 Subject: [PATCH 2/2] avcodec/v210dec: reject a custom_stride that is not a multiple of 4 Found during triage/review of the security report Qf1CTWcULyGL Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/v210dec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/v210dec.c b/libavcodec/v210dec.c index c4ca12c1f7..63337941fd 100644 --- a/libavcodec/v210dec.c +++ b/libavcodec/v210dec.c @@ -42,6 +42,11 @@ static av_cold int decode_init(AVCodecContext *avctx) { V210DecContext *s = avctx->priv_data; + if (s->custom_stride > 0 && s->custom_stride & 3) { + av_log(avctx, AV_LOG_ERROR, "custom_stride must be a multiple of 4\n"); + return AVERROR(EINVAL); + } + avctx->pix_fmt = AV_PIX_FMT_YUV422P10; avctx->bits_per_raw_sample = 10; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
