github-mirrors/FFmpeg
1
0
Fork 0
mirror of https://mirror.skon.top/https://github.com/FFmpeg/FFmpeg synced 2026-04-20 21:00:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

avformat/img2dec: Check avio_size() for failure

Browse Source 
More complete fix for #YWH-PGM40646-32

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-01-05 18:07:49 +01:00
parent 19c78cd6d9
commit 521d18cea3
1 changed files with 7 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
libavformat/img2dec.c
View File

@@ -367,7 +367,6 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
int i, res;
int ret[3] = { 0 };
int64_t size[3] = { 0 };
int64_t total_size;
AVIOContext *f[3] = { NULL };
AVCodecParameters *par = s1->streams[0]->codecpar;
@@ -458,15 +457,13 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
}
}
total_size = size[0];
if (total_size > INT64_MAX - size[1])
return AVERROR_INVALIDDATA;
total_size += size[1];
if (total_size > INT64_MAX - size[2])
return AVERROR_INVALIDDATA;
total_size += size[2];
if (total_size > INT_MAX)
return AVERROR_INVALIDDATA;
int total_size = 0;
for (int i = 0; i < 3; i++) {
if ((uint64_t)size[i] > INT_MAX - total_size)
return AVERROR_INVALIDDATA;
total_size += size[i];
}
res = av_new_packet(pkt, total_size);
if (res < 0) {