eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-16 04:32:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

avformat/img2enc: Check split planes packet size

Browse Source 
Fixes: out of array read
Fixes: VULN-6/poc.raw

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ca1c1f29ce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-01-23 00:34:56 +01:00
parent 46d134c4c9
commit a120b52bdf
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavformat/img2enc.c
+6
View File
@@ -191,6 +191,12 @@ static int write_packet(AVFormatContext *s, AVPacket *pkt)
ysize *= 2;
usize *= 2;
}
if (ysize + 2*usize + (desc->nb_components > 3) * ysize > pkt->size) {
ret = AVERROR(EINVAL);
goto fail;
}
avio_write(pb[0], pkt->data , ysize);
avio_write(pb[1], pkt->data + ysize , usize);
avio_write(pb[2], pkt->data + ysize + usize, usize);