PR #24671 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24671 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24671.patch
Fixes: out of array read Fixes: twp2aA6PnymU Found-by: Mohamed K. Fathy <[email protected]> >From 5b3d081fad34f8ef83caca1797fbdc5ca24db90e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 24 Sep 2026 00:47:48 +0200 Subject: [PATCH] avformat/webpenc: reject a VP8X chunk that extends past the packet Fixes: out of array read Fixes: twp2aA6PnymU Found-by: Mohamed K. Fathy <[email protected]> --- libavformat/webpenc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/webpenc.c b/libavformat/webpenc.c index 5d0eed5a8e..88e35a315b 100644 --- a/libavformat/webpenc.c +++ b/libavformat/webpenc.c @@ -88,9 +88,12 @@ static int flush(AVFormatContext *s, int trailer, int64_t pts) skip = 12; if (AV_RL32(w->last_pkt->data + skip) == AV_RL32("VP8X")) { + int64_t vp8x_end = skip + 8 + (int64_t)AV_RL32(w->last_pkt->data + skip + 4); + if (vp8x_end > w->last_pkt->size) + return AVERROR_INVALIDDATA; flags |= w->last_pkt->data[skip + 4 + 4]; vp8x = 1; - skip += AV_RL32(w->last_pkt->data + skip + 4) + 8; + skip = vp8x_end; } if (!w->wrote_webp_header) { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
