From 2864ce5e28e5627aa03aad645e25deaa98c39889 Mon Sep 17 00:00:00 2001 From: Marco Reimann Date: Tue, 23 Jun 2026 04:14:59 +0200 Subject: [PATCH] avcodec/nellymoserdec: Check block count to avoid integer overflow Fixes: out of array access Fixes: nelly.avi / gen_nelly_overflow.py Fixes: pgc86PfE7ZpA Fixes: 0eea21294354 (Add avcodec_decode_audio4().) Signed-off-by: Michael Niedermayer (cherry picked from commit f9482e1d01d7ae9395194f3c84b1d67dfb65c645) Signed-off-by: Michael Niedermayer --- libavcodec/nellymoserdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/nellymoserdec.c b/libavcodec/nellymoserdec.c index 36477173ff..7037d6b0ba 100644 --- a/libavcodec/nellymoserdec.c +++ b/libavcodec/nellymoserdec.c @@ -156,8 +156,8 @@ static int decode_tag(AVCodecContext *avctx, AVFrame *frame, blocks = buf_size / NELLY_BLOCK_LEN; - if (blocks <= 0) { - av_log(avctx, AV_LOG_ERROR, "Packet is too small\n"); + if (blocks <= 0 || blocks > INT_MAX / NELLY_SAMPLES) { + av_log(avctx, AV_LOG_ERROR, "Packet is too small or too large\n"); return AVERROR_INVALIDDATA; }