github-mirrors/FFmpeg
1
0
Fork 0
mirror of https://mirror.skon.top/https://github.com/FFmpeg/FFmpeg synced 2026-04-20 12:50:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

avformat/img2enc: Check split planes packet size

Browse Source 
Fixes: out of array read
Fixes: VULN-6/poc.raw

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-01-23 00:34:56 +01:00
parent b740b85872
commit ca1c1f29ce
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libavformat/img2enc.c
View File

@@ -217,6 +217,11 @@ static int write_packet(AVFormatContext *s, AVPacket *pkt)
ysize *= 2;
usize *= 2;
}
if (ysize + 2*usize + (desc->nb_components > 3) * ysize > pkt->size) {
ret = AVERROR(EINVAL);
goto fail;
}
if ((ret = write_and_close(s, &pb[0], pkt->data , ysize)) < 0 ||
(ret = write_and_close(s, &pb[1], pkt->data + ysize , usize)) < 0 ||
(ret = write_and_close(s, &pb[2], pkt->data + ysize + usize, usize)) < 0)