This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 8880a174d08131f94f58a0492d1c8c6d68b74f67 Author: Joshua Rogers <[email protected]> AuthorDate: Tue Aug 4 12:11:55 2026 +0000 Commit: Michael Niedermayer <[email protected]> CommitDate: Wed Aug 12 04:51:58 2026 +0200 avformat/librist: honor the caller buffer size in librist_read librist_read() ignored its size argument and copied the full payload_len, overflowing a smaller destination (e.g. via the async: wrapper). Clamp the copy to the caller-provided buffer size. Fixes: out of array access (cherry picked from commit 1c10bcc2e17255dacb717a25ab3db142ce390602) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/librist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/librist.c b/libavformat/librist.c index 9669d5b5df..3c4b5e3e5b 100644 --- a/libavformat/librist.c +++ b/libavformat/librist.c @@ -226,7 +226,7 @@ static int librist_read(URLContext *h, uint8_t *buf, int size) } } - size = data_block->payload_len; + size = FFMIN(data_block->payload_len, size); memcpy(buf, data_block->payload, size); out_free: rist_receiver_data_block_free2(&data_block); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
