From ab5043f055de39e34d21c9acfe0ec1e115af94bf Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 31 May 2026 16:45:47 +0200
Subject: [PATCH] avcodec/sanm: reject codec37 frames taller than the allocated
 buffer

No testcase

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/sanm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
index ab2e878030..749d003a1b 100644
--- a/libavcodec/sanm.c
+++ b/libavcodec/sanm.c
@@ -1241,6 +1241,9 @@ static int old_codec37(SANMVideoContext *ctx, GetByteContext *gb, int top, int l
     if (width > ctx->aligned_width)
         return AVERROR_INVALIDDATA;
 
+    if (FFALIGN(height, 4) > ctx->aligned_height)
+        return AVERROR_INVALIDDATA;
+
     if (bytestream2_get_bytes_left(gb) < 16)
         return AVERROR_INVALIDDATA;