Files
FFmpeg/libavcodec
Oliver Chang 9849a274df avcodec/dpx: Fix heap-buffer-overflow in 16-bit decoding
Fixes a heap-buffer-overflow in `libavcodec/dpx.c` triggered by a stale
`unpadded_10bit` flag in the `DPXDecContext`. This flag, set for 10-bit
unpadded frames, persisted across `decode_frame` calls. If a subsequent
frame was 16-bit, the stale flag caused incorrect buffer size
validation, allowing truncated buffers to pass checks designed for
smaller 10-bit packed data. This led to an out-of-bounds read in
`av_image_copy_plane` during 16-bit decoding.

The fix explicitly resets `dpx->unpadded_10bit = 0` at the start of
`decode_frame` to ensure correct validation for each frame.

Fixes: https://issues.oss-fuzz.com/issues/464471792
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array read
Fixes: 464471792/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DPX_DEC_fuzzer-5275522210004992
2025-12-07 19:41:02 +00:00
..
2025-11-05 15:13:54 +00:00
2025-11-05 16:31:59 +00:00
2025-11-26 15:16:42 +01:00
2025-11-08 18:48:54 +01:00
2025-11-08 01:17:46 +01:00
2025-10-30 03:41:24 +01:00
2025-11-26 15:16:43 +01:00
2025-11-09 02:42:17 +01:00
2025-11-10 01:46:52 +00:00
2025-11-04 10:28:57 +00:00
2025-11-27 11:34:25 +01:00
2025-12-04 15:08:46 +01:00