avformat/oggenc: Reset the current page when it cannot be buffered

On allocation failure the full page stayed in the stream context, and
the next segment was added past its 255 entry segment table.

Fixes: out of array access
Fixes: flOsaBhTFc6F
Fixes: AISLE-2026-0111-00072
Negative size memset Replicated through API with ASAN and av_max_alloc() lowered after the header
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

(cherry picked from commit 6d40aa1739)
This commit is contained in:
Michael Niedermayer authored and Romain Beauxis committed 2026-10-31 22:14:40 +00:00
1 parent 7adfbe40dc
commit d1f97282db
1 file changed
+3 -1
+3 -1
View File
@@ -192,8 +192,10 @@ static int ogg_buffer_page(AVFormatContext *s, OGGStreamContext *oggstream)
OGGPageList **p = &ogg->page_list;
OGGPageList *l = av_mallocz(sizeof(*l));
if (!l)
if (!l) {
ogg_reset_cur_page(oggstream);
return AVERROR(ENOMEM);
}
l->page = oggstream->page;
oggstream->page.start_granule = ogg_granule_to_timestamp(oggstream, oggstream->page.granule);