From aa4b80b54ee8645b5a77fe835ab2bbae1c9c465c Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 31 Oct 2026 05:18:04 +0100
Subject: [PATCH] avcodec/psd: reject an uncompressed image size above INT_MAX

Fixes: out of array write
Fixes: MymIHidCHVJu
Fixes: AISLE-2026-0150-00348
Out of array write Replicated through UnModified FFmpeg (32-bit) with ASAN

Found-by: Joshua Rogers (AISLE)
---
 libavcodec/psd.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/psd.c b/libavcodec/psd.c
index 9dc56f8f5e..f4973ecb7e 100644
--- a/libavcodec/psd.c
+++ b/libavcodec/psd.c
@@ -444,6 +444,8 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture,
     }
 
     s->uncompressed_size = s->line_size * s->height * s->channel_count;
+    if (s->uncompressed_size > INT_MAX)
+        return AVERROR_INVALIDDATA;
 
     /* decode picture if need */
     if (s->compression == PSD_RLE) {