PR #20810 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20810 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20810.patch
Fixes: out of array access no testcase Found-by: Joshua Rogers <[email protected]> with ZeroPath Signed-off-by: Michael Niedermayer <[email protected]> >From ac541f9e21806a4a0a0db1815582da7dfb944625 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 31 Oct 2025 23:31:40 +0100 Subject: [PATCH] avcodec/mediacodecdec_common: Check that the input to mediacodec_wrap_sw_audio_buffer() contains channel * sample_size Fixes: out of array access no testcase Found-by: Joshua Rogers <[email protected]> with ZeroPath Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/mediacodecdec_common.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/mediacodecdec_common.c b/libavcodec/mediacodecdec_common.c index ae336ab835..9b91c8edf5 100644 --- a/libavcodec/mediacodecdec_common.c +++ b/libavcodec/mediacodecdec_common.c @@ -385,6 +385,12 @@ static int mediacodec_wrap_sw_audio_buffer(AVCodecContext *avctx, goto done; } + if (info->size % (sample_size * avctx->ch_layout.nb_channels)) { + av_log(avctx, AV_LOG_ERROR, "input is not a multiple of channels * sample_size\n"); + ret = AVERROR(EINVAL); + goto done; + } + frame->format = avctx->sample_fmt; frame->sample_rate = avctx->sample_rate; frame->nb_samples = info->size / (sample_size * avctx->ch_layout.nb_channels); -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
