PR #24847 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24847 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24847.patch
Fixes: signed integer overflow: 1073790975 * 2 cannot be represented in type 'int' Fixes: PKTwNdHfFZne/testcase/poc.dvbsub Fixes: PKTwNdHfFZne Fixes: OOM Found-by: mzfr <[email protected]> Suggested-by: mzfr >From f9b8434aa95fb638e2c8013831ff519c80e3853f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 2 Oct 2026 02:11:30 +0200 Subject: [PATCH] avcodec/dvbsubdec: check the pixel buffer constraint without int overflow Fixes: signed integer overflow: 1073790975 * 2 cannot be represented in type 'int' Fixes: PKTwNdHfFZne/testcase/poc.dvbsub Fixes: PKTwNdHfFZne Fixes: OOM Found-by: mzfr <[email protected]> Suggested-by: mzfr --- libavcodec/dvbsubdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/dvbsubdec.c b/libavcodec/dvbsubdec.c index db8a9d1eb1..7608a44423 100644 --- a/libavcodec/dvbsubdec.c +++ b/libavcodec/dvbsubdec.c @@ -1189,7 +1189,7 @@ static int dvbsub_parse_region_segment(AVCodecContext *avctx, buf += 2; ret = av_image_check_size2(region->width, region->height, avctx->max_pixels, AV_PIX_FMT_PAL8, 0, avctx); - if (ret >= 0 && region->width * region->height * 2 > 320 * 1024 * 8) { + if (ret >= 0 && region->width * region->height > 320 * 1024 * 8 / 2) { ret = AVERROR_INVALIDDATA; av_log(avctx, AV_LOG_ERROR, "Pixel buffer memory constraint violated\n"); } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
