This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch release/7.1
in repository ffmpeg.
The following commit(s) were added to refs/heads/release/7.1 by this push:
new 7ce7207770 avformat/img2dec: reject input images too big to fit into a
single packet
7ce7207770 is described below
commit 7ce72077704d5351d2c4a8d06016548e0f8a730c
Author: Timo Rothenpieler <[email protected]>
AuthorDate: Wed Dec 31 03:41:21 2025 +0100
Commit: Timo Rothenpieler <[email protected]>
CommitDate: Wed Dec 31 17:48:24 2025 +0100
avformat/img2dec: reject input images too big to fit into a single packet
Not entirely sure if it should instead use some entirely different
approach here, given that images exceeding 2GB don't seem that crazy
to me, but so far processing such images results in a heap overflow,
since the size addition overflows and a much too small packet is
allocated and its size never checked again when writing into it.
Fixes #YWH-PGM40646-32
(cherry picked from commit f6a95c7eb786f895812adaaa08d2fe91c4d4caf8)
---
libavformat/img2dec.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c
index 3389fa818e..2bcbfafdfc 100644
--- a/libavformat/img2dec.c
+++ b/libavformat/img2dec.c
@@ -416,8 +416,10 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
char filename_bytes[1024];
char *filename = filename_bytes;
int i, res;
- int size[3] = { 0 }, ret[3] = { 0 };
- AVIOContext *f[3] = { NULL };
+ int ret[3] = { 0 };
+ int64_t size[3] = { 0 };
+ int64_t total_size;
+ AVIOContext *f[3] = { NULL };
AVCodecParameters *par = s1->streams[0]->codecpar;
if (!s->is_pipe) {
@@ -497,7 +499,17 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
}
}
- res = av_new_packet(pkt, size[0] + size[1] + size[2]);
+ total_size = size[0];
+ if (total_size > INT64_MAX - size[1])
+ return AVERROR_INVALIDDATA;
+ total_size += size[1];
+ if (total_size > INT64_MAX - size[2])
+ return AVERROR_INVALIDDATA;
+ total_size += size[2];
+ if (total_size > INT_MAX)
+ return AVERROR_INVALIDDATA;
+
+ res = av_new_packet(pkt, total_size);
if (res < 0) {
goto fail;
}
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
