From 705ff11c2b02d2925fca5c2c78c547ccbd901182 Mon Sep 17 00:00:00 2001 From: Jiale Yao Date: Sat, 11 Jul 2026 16:46:26 +0200 Subject: [PATCH] avcodec/libcodec2: reject packet sample counts that overflow int Fixes: out of array access Fixes: 2jy_poc_codec2.zip / poc_codec2.raw Fixes: jOQASNnOm6O7 Found-by: Jiale Yao --- libavcodec/libcodec2.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/libcodec2.c b/libavcodec/libcodec2.c index 8895865721..ca74b2beb6 100644 --- a/libavcodec/libcodec2.c +++ b/libavcodec/libcodec2.c @@ -132,6 +132,8 @@ static int libcodec2_decode(AVCodecContext *avctx, AVFrame *frame, int16_t *output; nframes = pkt->size / avctx->block_align; + if (nframes > INT_MAX / avctx->frame_size) + return AVERROR_INVALIDDATA; frame->nb_samples = avctx->frame_size * nframes; ret = ff_get_buffer(avctx, frame, 0);