PR #23799 opened by mirko URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23799 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23799.patch
**ACAMERA_SCALER_AVAILABLE_STREAM_CONFIGURATIONS** metadata is an `int32[n*4]` array (one 4-tuple per stream config: format, width, height, input/output flag). `ACameraMetadata_const_entry.count` is the total number of `int32_t` elements, not the number of tuples. The loop bound must be `count/4` to avoid iterating past the end of the array. Similarly, **ACAMERA_CONTROL_AE_AVAILABLE_TARGET_FPS_RANGES** is an `int32[n*2]` array (min/max pairs). The loop bound must be `count/2`. Without this fix, both loops over-iterate and read heap memory beyond the metadata array bounds. Signed-off-by: Mirko <[email protected]> >From 88ba4a93ebc10185aad40cd1d1440f03b7ae8fa5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mirk=C3=B3=20Visontai?= <[email protected]> Date: Mon, 13 Jul 2026 11:15:28 -0700 Subject: [PATCH] avdevice/android_camera: fix OOB read in match_video_size and match_framerate ACAMERA_SCALER_AVAILABLE_STREAM_CONFIGURATIONS metadata is an int32[n*4] array (one 4-tuple per stream config: format, width, height, input/output flag). ACameraMetadata_const_entry.count is the total number of int32_t elements, not the number of tuples. The loop bound must be count/4 to avoid iterating past the end of the array. Similarly, ACAMERA_CONTROL_AE_AVAILABLE_TARGET_FPS_RANGES is an int32[n*2] array (min/max pairs). The loop bound must be count/2. Without this fix both loops over-iterate and read heap memory beyond the metadata array bounds. Signed-off-by: Mirko <[email protected]> --- libavdevice/android_camera.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavdevice/android_camera.c b/libavdevice/android_camera.c index 8433286296..7abdb6bd7b 100644 --- a/libavdevice/android_camera.c +++ b/libavdevice/android_camera.c @@ -249,7 +249,7 @@ static void match_video_size(AVFormatContext *avctx) ACAMERA_SCALER_AVAILABLE_STREAM_CONFIGURATIONS, &available_configs); - for (int i = 0; i < available_configs.count; i++) { + for (int i = 0; i < available_configs.count / 4; i++) { int32_t input = available_configs.data.i32[i * 4 + 3]; int32_t format = available_configs.data.i32[i * 4 + 0]; @@ -296,7 +296,7 @@ static void match_framerate(AVFormatContext *avctx) ACAMERA_CONTROL_AE_AVAILABLE_TARGET_FPS_RANGES, &available_framerates); - for (int i = 0; i < available_framerates.count; i++) { + for (int i = 0; i < available_framerates.count / 2; i++) { int32_t min = available_framerates.data.i32[i * 2 + 0]; int32_t max = available_framerates.data.i32[i * 2 + 1]; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
