PR #24178 opened by myage5000
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24178
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24178.patch
In buf_realloc, os->bufsize is unsigned int and the code doubles it:
nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE);
When os->bufsize exceeds UINT_MAX/2, the multiplication overflows
to a small value, av_realloc returns a tiny buffer, and the subsequent
page write in ogg_read_page goes out of bounds.
Reject the reallocation before the overflow can occur.
Signed-off-by: age5000 <[email protected]>
# Summary of changes
Briefly describe what this PR does and why.
<!--
If this PR requires new FATE test samples, attach them to the PR and
list their target paths below (relative to the fate-suite root).
Attached filenames must match the sample's filename:
```fate-samples
# e.g. vorbis/new-sample.ogg
```
-->
>From eabc00832180dddd19c91d421035321c6d2fb77e Mon Sep 17 00:00:00 2001
From: zhorzhetta1404-ux <[email protected]>
Date: Mon, 17 Aug 2026 13:07:08 +0300
Subject: [PATCH] avformat/oggdec: check for integer overflow in buf_realloc
In buf_realloc, os->bufsize is unsigned int and the code doubles it:
nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE);
When os->bufsize exceeds UINT_MAX/2, the multiplication overflows
to a small value, av_realloc returns a tiny buffer, and the subsequent
page write in ogg_read_page goes out of bounds.
Reject the reallocation before the overflow can occur.
Signed-off-by: age5000 <[email protected]>
---
libavformat/oggdec.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c
index 1f8f78e369..ffa72909f1 100644
--- a/libavformat/oggdec.c
+++ b/libavformat/oggdec.c
@@ -304,7 +304,10 @@ static int buf_realloc(struct ogg_stream *os, int size)
{
/* Even if invalid guarantee there's enough memory to read the page */
if (os->bufsize - os->bufpos < size) {
- uint8_t *nb = av_realloc(os->buf, 2*os->bufsize +
AV_INPUT_BUFFER_PADDING_SIZE);
+ uint8_t *nb;
+ if (os->bufsize > UINT_MAX / 2)
+ return AVERROR(ENOMEM);
+ nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE);
if (!nb)
return AVERROR(ENOMEM);
os->buf = nb;
--
2.52.0
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
