PR #24485 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24485 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24485.patch
Fixes: 2MzQLLrSXH8j Fixes: out of array write Found-by: Zheng Yu @ Depthfirst >From 5b9a76927ae705bd5b4e951105d8fc5a20bde085 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 14 Sep 2026 02:27:37 +0200 Subject: [PATCH] avcodec/cook: require the channel mask to cover every subpacket channel Fixes: 2MzQLLrSXH8j Fixes: out of array write Found-by: Zheng Yu @ Depthfirst --- libavcodec/cook.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/cook.c b/libavcodec/cook.c index 8256afc2e4..5ed3d2596b 100644 --- a/libavcodec/cook.c +++ b/libavcodec/cook.c @@ -1249,6 +1249,12 @@ static av_cold int cook_decode_init(AVCodecContext *avctx) s++; } + if (channel_mask && av_popcount(channel_mask) != total_channels) { + av_log(avctx, AV_LOG_ERROR, "Channel mask 0x%x does not match %d subpacket channels\n", + channel_mask, total_channels); + return AVERROR_INVALIDDATA; + } + /* Try to catch some obviously faulty streams, otherwise it might be exploitable */ if (q->samples_per_channel != 256 && q->samples_per_channel != 512 && q->samples_per_channel != 1024) { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
