PR #24758 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24758 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24758.patch
Fixes: heap-buffer-overflow Fixes: d8mJHYOGopsd Found-by: Hongduo Zhao >From e500c241e3c68f28694eb140ae736f90068038c9 Mon Sep 17 00:00:00 2001 From: Hongduo Zhao <[email protected]> Date: Fri, 25 Sep 2026 05:34:29 +0200 Subject: [PATCH] avcodec/snowenc: check the frame number against the pass-2 statistics before indexing them Fixes: heap-buffer-overflow Fixes: d8mJHYOGopsd Found-by: Hongduo Zhao --- libavcodec/snowenc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/snowenc.c b/libavcodec/snowenc.c index 45446e5479..13ca651fcd 100644 --- a/libavcodec/snowenc.c +++ b/libavcodec/snowenc.c @@ -1807,6 +1807,11 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt, mpv->picture_number = avctx->frame_num; if(avctx->flags&AV_CODEC_FLAG_PASS2){ + if (avctx->frame_num >= enc->m.rc_context.num_entries) { + av_log(avctx, AV_LOG_ERROR, + "Pass-2 statistics contain fewer frames than the input.\n"); + return AVERROR_INVALIDDATA; + } mpv->c.pict_type = pic->pict_type = enc->m.rc_context.entry[avctx->frame_num].new_pict_type; s->keyframe = pic->pict_type == AV_PICTURE_TYPE_I; if(!(avctx->flags&AV_CODEC_FLAG_QSCALE)) { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
