github-mirrors/FFmpeg
1
0
Fork 0
mirror of https://mirror.skon.top/https://github.com/FFmpeg/FFmpeg synced 2026-04-20 12:50:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

avformat/icodec: Check size

Browse Source 
Fixes: signed integer overflow: 14 + 2147483647 cannot be represented in type 'int'
Fixes: 471688026/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5616495813263360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-02-14 01:39:22 +01:00
committed by michaelni
parent a7a009a3eb
commit 237d03717f
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/icodec.c
View File

@@ -113,7 +113,7 @@ static int read_header(AVFormatContext *s)
avio_skip(pb, 5);
ico->images[i].size = avio_rl32(pb);
if (ico->images[i].size <= 0) {
if (ico->images[i].size <= 0 || ico->images[i].size > INT_MAX - 14) {
av_log(s, AV_LOG_ERROR, "Invalid image size %d\n", ico->images[i].size);
return AVERROR_INVALIDDATA;
}