Hi, While auditing 4xm.c I noticed the per-macroblock bounds check in decode_i2_frame() can never trigger: 'buf' is never advanced inside the loop (all reads go through the GetByteContext 'g3'), so 'buf_end - buf' is always equal to 'length'. The patch below checks the actual read cursor instead, matching the guards used elsewhere in this file.
(This was also previously flagged by an automated scan; I verified it is still present on current master.) >From 898f4ce1410baac9736e13bdab3f5cc9e68bd4b0 Mon Sep 17 00:00:00 2001 From: Ian Lay <[email protected]> Date: Sun, 11 Oct 2026 15:01:52 +0800 Subject: [PATCH] avcodec/4xm: fix dead bounds check in decode_i2_frame The 'if (buf_end - buf < 8)' check inside the macroblock loop can never trigger: 'buf' is never advanced in the loop (all reads go through the GetByteContext 'g3'), so 'buf_end - buf' is always equal to 'length', which was already validated against 'mbs * 8' above. Check the actual read cursor with bytestream2_get_bytes_left(&g3) instead, matching the guards used elsewhere in this file. This makes the per-macroblock overread protection effective rather than relying solely on the upfront size check. --- libavcodec/4xm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index c6b2ce1..530437a 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -729,7 +729,6 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length) const int height = f->avctx->height; const int mbs = (FFALIGN(width, 16) >> 4) * (FFALIGN(height, 16) >> 4); uint16_t *dst = f->frame_buffer; - const uint8_t *buf_end = buf + length; GetByteContext g3; if (length < mbs * 8) { @@ -741,7 +740,7 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length) for (y = 0; y < height; y += 16) { for (x = 0; x < width; x += 16) { unsigned int color[4] = { 0 }, bits; - if (buf_end - buf < 8) + if (bytestream2_get_bytes_left(&g3) < 8) return AVERROR_INVALIDDATA; // warning following is purely guessed ... color[0] = bytestream2_get_le16u(&g3); -- 2.43.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
