PR #25337 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25337 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25337.patch
Copy the same number of bytes the little-endian path consumes; the remaining bytes are left to the next call, which rejects them. Fixes: 6zek0xDeEzFA Regression since: bc057f7592 Fixes: heap buffer overflow Heap buffer overflow write Replicated through UnModified FFmpeg with a guard page allocator (big-endian s390x build under qemu-user) Found during review of PR #23393 >From f0276f752f604f875e33ff90027b37743431e491 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 21 Oct 2026 18:26:56 +0200 Subject: [PATCH] avcodec/pcm-bluray: copy only whole samples on big-endian hosts Copy the same number of bytes the little-endian path consumes; the remaining bytes are left to the next call, which rejects them. Fixes: 6zek0xDeEzFA Regression since: bc057f7592 Fixes: heap buffer overflow Heap buffer overflow write Replicated through UnModified FFmpeg with a guard page allocator (big-endian s390x build under qemu-user) Found during review of PR #23393 --- libavcodec/pcm-bluray.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/pcm-bluray.c b/libavcodec/pcm-bluray.c index 194224c67eb..fba7c8656d1 100644 --- a/libavcodec/pcm-bluray.c +++ b/libavcodec/pcm-bluray.c @@ -167,7 +167,7 @@ static int pcm_bluray_decode_frame(AVCodecContext *avctx, AVFrame *frame, samples *= num_source_channels; if (AV_SAMPLE_FMT_S16 == avctx->sample_fmt) { #if HAVE_BIGENDIAN - bytestream2_get_buffer(&gb, (uint8_t*)dst16, buf_size); + bytestream2_get_buffer(&gb, (uint8_t*)dst16, samples * 2); #else do { *dst16++ = bytestream2_get_be16u(&gb); -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
