dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-13 17:07:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/nellymoserdec: Check block count to avoid integer overflow

Browse Source 
Fixes: out of array access
Fixes: nelly.avi / gen_nelly_overflow.py
Fixes: pgc86PfE7ZpA
Fixes: 0eea212943 (Add avcodec_decode_audio4().)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f9482e1d01)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Marco Reimann
2026-06-23 04:14:59 +02:00
committed by Michael Niedermayer
parent 3abec89a45
commit 2864ce5e28
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/nellymoserdec.c
View File

@@ -156,8 +156,8 @@ static int decode_tag(AVCodecContext *avctx, AVFrame *frame,
blocks = buf_size / NELLY_BLOCK_LEN;
if (blocks <= 0) {
av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
if (blocks <= 0 || blocks > INT_MAX / NELLY_SAMPLES) {
av_log(avctx, AV_LOG_ERROR, "Packet is too small or too large\n");
return AVERROR_INVALIDDATA;
}