PR #22756 opened by joaonevess URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22756 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22756.patch
rle_uncompress() silently discards the return value of rle(). When the compressed data is malformed and rle() returns AVERROR_INVALIDDATA, processing continues on a partially filled buffer. Propagate the error to the caller, which already handles it at line 1420. Signed-off-by: João Neves <[email protected]> From c926f68ba0342308dedab282a1547b92cba1e047 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Neves?= <[email protected]> Date: Wed, 8 Apr 2026 12:56:50 -0700 Subject: [PATCH] avcodec/exr: check rle() return value in rle_uncompress() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit rle_uncompress() silently discards the return value of rle(). When the compressed data is malformed and rle() returns AVERROR_INVALIDDATA, processing continues on a partially filled buffer. Propagate the error to the caller, which already handles it at line 1420. Signed-off-by: João Neves <[email protected]> --- libavcodec/exr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/exr.c b/libavcodec/exr.c index c7fcd302cd..6b52c7e8ef 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -267,7 +267,9 @@ static int rle(uint8_t *dst, const uint8_t *src, static int rle_uncompress(const EXRContext *ctx, const uint8_t *src, int compressed_size, int uncompressed_size, EXRThreadData *td) { - rle(td->tmp, src, compressed_size, uncompressed_size); + int ret = rle(td->tmp, src, compressed_size, uncompressed_size); + if (ret < 0) + return ret; av_assert1(uncompressed_size % 2 == 0); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
