From d3f59f9b7fdc09090970b314cde58c906cc86efd Mon Sep 17 00:00:00 2001 From: amhurtado Date: Tue, 19 May 2026 15:55:21 -0500 Subject: [PATCH] avcodec/prores_raw: reject invalid tile alignment values Fixes: out of array access Regression since d8cb567 ("prores_raw: fix tile alignment issues"). Found-by: amhurtado Signed-off-by: amhurtado --- libavcodec/prores_raw.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/prores_raw.c b/libavcodec/prores_raw.c index f386b22496..db6bfcd6eb 100644 --- a/libavcodec/prores_raw.c +++ b/libavcodec/prores_raw.c @@ -427,6 +427,11 @@ static int decode_frame(AVCodecContext *avctx, /* Flags */ int flags = bytestream2_get_be16(&gb_hdr); int align = (flags >> 1) & 0x7; + if (align > 4) { + av_log(avctx, AV_LOG_ERROR, + "Invalid tile alignment %d (max 4)\n", align); + return AVERROR_INVALIDDATA; + } /* Quantization matrix */ if (flags & 1)