From ad25ca73b56cf5b2933fb2d38902dfa5913104ec Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 11 Jul 2026 17:01:30 +0200 Subject: [PATCH] avcodec/dovi_rpudec: bound num_x/y_partitions Fixes: out of array access Fixes: SUcVEyk7r3Gc Found-by: Kenan Alghythee (cherry picked from commit 79e10e51960f848b82c597c540087bcc66aa6e17) Signed-off-by: Michael Niedermayer --- libavcodec/dovi_rpudec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/dovi_rpudec.c b/libavcodec/dovi_rpudec.c index d210ba52cf..ba4e7cd214 100644 --- a/libavcodec/dovi_rpudec.c +++ b/libavcodec/dovi_rpudec.c @@ -582,6 +582,8 @@ int ff_dovi_rpu_parse(DOVIContext *s, const uint8_t *rpu, size_t rpu_size, mapping->num_x_partitions = get_ue_golomb_long(gb) + 1; mapping->num_y_partitions = get_ue_golomb_long(gb) + 1; + VALIDATE(mapping->num_x_partitions, 1, 0xFFFF); + VALIDATE(mapping->num_y_partitions, 1, 0xFFFF); /* End of rpu_data_header(), start of vdr_rpu_data_payload() */ for (int c = 0; c < 3; c++) {