PR #23777 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23777 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23777.patch
Fixes: NULL pointer dereference Fixes: 4jy_poc_cavs.zip / poc_cavs.avi Fixes: UH66Y8Om9F8X Found-by: Jiale Yao <[email protected]> >From 17bf1dbee602d78ba14d6bace30510d77dd864ef Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 11 Jul 2026 16:46:17 +0200 Subject: [PATCH] avcodec/cavsdec: reject invalid start-code bitreader sizes Fixes: NULL pointer dereference Fixes: 4jy_poc_cavs.zip / poc_cavs.avi Fixes: UH66Y8Om9F8X Found-by: Jiale Yao <[email protected]> --- libavcodec/cavsdec.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c index bc1ed60bf0..b6dd5f2d3f 100644 --- a/libavcodec/cavsdec.c +++ b/libavcodec/cavsdec.c @@ -1266,10 +1266,11 @@ static int cavs_decode_frame(AVCodecContext *avctx, AVFrame *rframe, av_log(h->avctx, AV_LOG_WARNING, "no frame decoded\n"); return FFMAX(0, buf_ptr - buf); } - input_size = (buf_end - buf_ptr) * 8; + input_size = buf_end - buf_ptr; + if ((ret = init_get_bits8(&h->gb, buf_ptr, input_size)) < 0) + return ret; switch (stc) { case CAVS_START_CODE: - init_get_bits(&h->gb, buf_ptr, input_size); decode_seq_header(h); break; case PIC_I_START_CODE: @@ -1288,7 +1289,6 @@ static int cavs_decode_frame(AVCodecContext *avctx, AVFrame *rframe, *got_frame = 0; if (!h->got_keyframe) break; - init_get_bits(&h->gb, buf_ptr, input_size); h->stc = stc; if (decode_pic(h)) break; @@ -1312,7 +1312,6 @@ static int cavs_decode_frame(AVCodecContext *avctx, AVFrame *rframe, break; default: if (stc <= SLICE_MAX_START_CODE) { - init_get_bits(&h->gb, buf_ptr, input_size); decode_slice_header(h, &h->gb); } break; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
