This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 947c57d9e68800dd4d39f110140f8f6c34cedf80 Author: Michael Niedermayer <[email protected]> AuthorDate: Mon Jun 29 01:16:44 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue Jul 21 22:59:52 2026 +0200 avcodec/mace: reject sample counts that overflow int Fixes: heap buffer overflow Fixes: FmXBI2dbgvgD Fixes: 0eea212943544d40f99b05571aa7159d78667154 (Add avcodec_decode_audio4().) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit aafb5c655edc76a753275c383ebb139feb032718) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/mace.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/mace.c b/libavcodec/mace.c index 299e5f5cfe..87e802684a 100644 --- a/libavcodec/mace.c +++ b/libavcodec/mace.c @@ -252,7 +252,10 @@ static int mace_decode_frame(AVCodecContext *avctx, AVFrame *frame, } /* get output buffer */ - frame->nb_samples = 3 * (buf_size << (1 - is_mace3)) / channels; + int64_t nb_samples = 3 * ((int64_t)buf_size << (1 - is_mace3)) / channels; + if (nb_samples > INT_MAX) + return AVERROR_INVALIDDATA; + frame->nb_samples = nb_samples; if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) return ret; samples = (int16_t **)frame->extended_data; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
