eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-16 04:32:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/exr: check ac_size

Browse Source 
Fixes: out of array read
Fixes: dwa_uncompress.py.crash.exr

The code will read from the ac data even if ac_size is 0, thus that case
is not implemented and we ask for a sample and error out cleanly

Found-by: Google Big Sleep

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e078826da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2025-09-18 17:32:46 +02:00
parent c20c664998
commit 447d98b072
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/exr.c
+5
View File
@@ -1023,6 +1023,11 @@ static int dwa_uncompress(EXRContext *s, const uint8_t *src, int compressed_size
)
return AVERROR_INVALIDDATA;
if (ac_size <= 0) {
avpriv_request_sample(s->avctx, "Zero ac_size");
return AVERROR_INVALIDDATA;
}
if ((uint64_t)rle_raw_size > INT_MAX) {
avpriv_request_sample(s->avctx, "Too big rle_raw_size");
return AVERROR_INVALIDDATA;