dilim/FFmpeg
1
0 Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-11-06 05:17:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/huffyuvdec: budget 33 bits per sample when choosing the unchecked 16 bit loop

Browse Source 
Fixes: heap-buffer-overflow (read)
Fixes: BIqbuSbTJqAH
Fixes: ANT-2026-V2EPGE9M
Fixes: poc.avi
Found-by: Claude and Ada Logics

Out of array read Replicated through UnModified FFmpeg with ASAN
This commit is contained in:
Michael Niedermayer authored and michaelni committed 2026-11-05 23:03:11 +00:00
1 parent 1436f56075
commit f6d70de099
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/huffyuvdec.c
+1 -1
View File
@@ -760,7 +760,7 @@ static void decode_plane_bitstream(HYuvDecContext *s, int width, int plane)
s->temp16[0][width - 1] = 0;
CLOSE_READER(re, &s->gb);
} else {
if (count >= (get_bits_left(&s->gb)) / (32 * 2)) {
if (count >= (get_bits_left(&s->gb)) / (33 * 2)) {
for (i = 0; i < count && get_bits_left(&s->gb) > 0; i++) {
READ_2PIX_PLANE16(s->temp16[0][2 * i], s->temp16[0][2 * i + 1], plane);
}