This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 1eb17d8ac040fa80a614b10f39853d5a9a51b01b Author: Michael Niedermayer <[email protected]> AuthorDate: Tue Jul 7 23:48:04 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue Jul 21 22:59:57 2026 +0200 avcodec/exr: bound total decoded pixels by max_pixels Use the maximum block dimensions decode_block() can assign after clipping the nominal tile or scanline block to the data window. Fixes: Timeout Fixes: 521392254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_DEC_fuzzer-6740984590565376 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 206f2d92db2e67914cb417b9e1efac191c3b0690) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/exr.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/libavcodec/exr.c b/libavcodec/exr.c index bef1d62485..0e9c734a10 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -2229,6 +2229,16 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture, if (bytestream2_get_bytes_left(gb)/8 < nb_blocks) return AVERROR_INVALIDDATA; + if (avctx->max_pixels) { + int64_t block_pixels = s->is_tile + ? (int64_t)FFMIN(s->tile_attr.xSize, s->xdelta) * + FFMIN(s->tile_attr.ySize, s->ydelta) + : (int64_t)s->xdelta * + FFMIN(s->scan_lines_per_block, s->ydelta); + if (nb_blocks > avctx->max_pixels / FFMAX(block_pixels, 1)) + return AVERROR_INVALIDDATA; + } + // check offset table and recreate it if need if (!s->is_tile && bytestream2_peek_le64(gb) == 0) { PutByteContext offset_table_writer; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
