xaymar/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/img2dec: Check avio_size() for failure

Browse Source 
More complete fix for #YWH-PGM40646-32

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 521d18cea3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-01-05 18:07:49 +01:00
parent b9c777ac2d
commit 6bef292824
1 changed files with 7 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavformat/img2dec.c
+7 -10
View File
@@ -411,7 +411,6 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
int i, res;
int ret[3] = { 0 };
int64_t size[3] = { 0 };
int64_t total_size;
AVIOContext *f[3] = { NULL };
AVCodecParameters *par = s1->streams[0]->codecpar;
@@ -492,15 +491,13 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
}
}
total_size = size[0];
if (total_size > INT64_MAX - size[1])
return AVERROR_INVALIDDATA;
total_size += size[1];
if (total_size > INT64_MAX - size[2])
return AVERROR_INVALIDDATA;
total_size += size[2];
if (total_size > INT_MAX)
return AVERROR_INVALIDDATA;
int total_size = 0;
for (int i = 0; i < 3; i++) {
if ((uint64_t)size[i] > INT_MAX - total_size)
return AVERROR_INVALIDDATA;
total_size += size[i];
}
res = av_new_packet(pkt, total_size);
if (res < 0) {