dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-08 17:11:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

avformat/spdifenc: bound DTS core_size against the packet size in the HD path

Browse Source 
Fixes: out of array read
Fixes: yBSax492UIB9
Fixes: 482d98f69b (spdifenc: IEC 61937 encapsulation of DTS-HD for HDMI)
Found-by: Pavel Kohout (Aisle Research)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6f80e27654)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-06-30 00:11:50 +02:00
parent 2ec918330e
commit 385ac2fadc
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/spdifenc.c
View File

@@ -225,7 +225,7 @@ static int spdif_header_dts4(AVFormatContext *s, AVPacket *pkt, int core_size,
* (dtshd_fallback == 0) */
ctx->dtshd_skip = 1;
}
if (ctx->dtshd_skip && core_size) {
if (ctx->dtshd_skip && core_size && core_size <= pkt->size) {
pkt_size = core_size;
if (ctx->dtshd_fallback >= 0)
--ctx->dtshd_skip;