avcodec/ffv1dec: Reject bayer with unaligned slice coordinates

Bayer was introduced (4f509c9e43) with combined_version 0x4000A, so no real
bayer stream uses the old unaligned coordinates; reject it. Odd picture
dimensions remain valid and are handled by aligning the bayer allocation to
2x2.

Fixes: out of array write
Fixes: fa6F4c0xA8el
Fixes: 4f509c9e43 (ffv1dec: implement Bayer pixel format encoding)
Found-by: Anonymous
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-06-26 20:58:49 +02:00
committed by michaelni
parent 11afa309fb
commit cc17277c36

View File

@@ -583,6 +583,12 @@ static int read_header(FFV1Context *f, RangeCoder *c)
if (ret < 0)
return ret;
if (f->bayer && f->combined_version <= 0x40002) {
av_log(f->avctx, AV_LOG_ERROR,
"Bayer requires aligned slice coordinates (combined_version > 0x40002)\n");
return AVERROR_INVALIDDATA;
}
if (f->configured_pix_fmt != f->pix_fmt ||
f->configured_width != f->width ||
f->configured_height != f->height ||