This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 6f80e27654 avformat/spdifenc: bound DTS core_size against the packet
size in the HD path
6f80e27654 is described below
commit 6f80e2765492700622596af720534cef33dd31b4
Author: Michael Niedermayer <[email protected]>
AuthorDate: Tue Jun 30 00:11:50 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Thu Jul 2 13:29:42 2026 +0000
avformat/spdifenc: bound DTS core_size against the packet size in the HD
path
Fixes: out of array read
Fixes: yBSax492UIB9
Fixes: 482d98f69b2 (spdifenc: IEC 61937 encapsulation of DTS-HD for HDMI)
Found-by: Pavel Kohout (Aisle Research)
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/spdifenc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/spdifenc.c b/libavformat/spdifenc.c
index ab3f73da0d..16eebda01c 100644
--- a/libavformat/spdifenc.c
+++ b/libavformat/spdifenc.c
@@ -225,7 +225,7 @@ static int spdif_header_dts4(AVFormatContext *s, AVPacket
*pkt, int core_size,
* (dtshd_fallback == 0) */
ctx->dtshd_skip = 1;
}
- if (ctx->dtshd_skip && core_size) {
+ if (ctx->dtshd_skip && core_size && core_size <= pkt->size) {
pkt_size = core_size;
if (ctx->dtshd_fallback >= 0)
--ctx->dtshd_skip;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
