PR #25696 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25696 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25696.patch
>From 4ef721ca75e25e13c1a4ffbcaa4db1949034e2b4 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 30 Oct 2026 19:05:53 +0100 Subject: [PATCH 1/2] avcodec/imc: reject blocks whose bit budget is already exceeded Fixes: infinite loop Fixes: signed integer overflow Fixes: BZhUOuyaOjUD Fixes: AISLE-2026-0150-00064 Infinite loop Replicated through UnModified FFmpeg with UBSAN Found-by: Joshua Rogers (AISLE) --- libavcodec/imc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/imc.c b/libavcodec/imc.c index fa02fd5d8a0..014f9bbfaa7 100644 --- a/libavcodec/imc.c +++ b/libavcodec/imc.c @@ -439,6 +439,9 @@ static int bit_allocation(IMCContext *q, IMCChannel *chctx, int flg; int found_indx = 0; + if (freebits < 0) + return AVERROR_INVALIDDATA; + for (i = 0; i < BANDS; i++) highest = FFMAX(highest, chctx->flcoeffs1[i]); -- 2.54.0 >From ecf6b8db9a245c402f27f945b15b793d47503b73 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 30 Oct 2026 19:05:53 +0100 Subject: [PATCH 2/2] avcodec/mpegaudiodec: fail on packets too large for the bit reader Fixes: NULL pointer dereference Fixes: signed integer overflow Fixes: LV4ZEjFMTZt7 Fixes: AISLE-2026-0150-00644 NULL pointer dereference Replicated through API with ASAN and UBSAN Found-by: Joshua Rogers (AISLE) --- libavcodec/mpegaudiodec_template.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/mpegaudiodec_template.c b/libavcodec/mpegaudiodec_template.c index 2ac7be3b807..b146307dd96 100644 --- a/libavcodec/mpegaudiodec_template.c +++ b/libavcodec/mpegaudiodec_template.c @@ -1475,7 +1475,9 @@ static int mp_decode_frame(MPADecodeContext *s, OUT_INT **samples, int i, nb_frames, ch, ret; OUT_INT *samples_ptr; - init_get_bits(&s->gb, buf + HEADER_SIZE, (buf_size - HEADER_SIZE) * 8); + ret = init_get_bits8(&s->gb, buf + HEADER_SIZE, buf_size - HEADER_SIZE); + if (ret < 0) + return ret; if (s->hdr.error_protection) s->crc = get_bits(&s->gb, 16); -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
