From d1f97282dbe658b94fa37546031fc2f236b1bf49 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 6 Oct 2026 07:33:05 +0200 Subject: [PATCH] avformat/oggenc: Reset the current page when it cannot be buffered On allocation failure the full page stayed in the stream context, and the next segment was added past its 255 entry segment table. Fixes: out of array access Fixes: flOsaBhTFc6F Fixes: AISLE-2026-0111-00072 Negative size memset Replicated through API with ASAN and av_max_alloc() lowered after the header Found-by: Joshua Rogers (cherry picked from commit 6d40aa17395aaba80922441bcfb58399a88475e3) --- libavformat/oggenc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/oggenc.c b/libavformat/oggenc.c index 5c7e3da0bc..cee9c01223 100644 --- a/libavformat/oggenc.c +++ b/libavformat/oggenc.c @@ -192,8 +192,10 @@ static int ogg_buffer_page(AVFormatContext *s, OGGStreamContext *oggstream) OGGPageList **p = &ogg->page_list; OGGPageList *l = av_mallocz(sizeof(*l)); - if (!l) + if (!l) { + ogg_reset_cur_page(oggstream); return AVERROR(ENOMEM); + } l->page = oggstream->page; oggstream->page.start_granule = ogg_granule_to_timestamp(oggstream, oggstream->page.granule);