breeze/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-01-12 00:06:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

avformat/img2dec: reject input images too big to fit into a single packet

Browse Source 
Not entirely sure if it should instead use some entirely different
approach here, given that images exceeding 2GB don't seem that crazy
to me, but so far processing such images results in a heap overflow,
since the size addition overflows and a much too small packet is
allocated and its size never checked again when writing into it.

Fixes #YWH-PGM40646-32

(cherry picked from commit f6a95c7eb7)
This commit is contained in:
Timo Rothenpieler
2025-12-31 03:41:21 +01:00
parent 9999b9a8b2
commit 80e99378c3
1 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
libavformat/img2dec.c
View File

@@ -414,8 +414,10 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
char filename_bytes[1024];
char *filename = filename_bytes;
int i, res;
int size[3] = { 0 }, ret[3] = { 0 };
AVIOContext *f[3] = { NULL };
int ret[3] = { 0 };
int64_t size[3] = { 0 };
int64_t total_size;
AVIOContext *f[3] = { NULL };
AVCodecParameters *par = s1->streams[0]->codecpar;
if (!s->is_pipe) {
@@ -495,7 +497,17 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
}
}
res = av_new_packet(pkt, size[0] + size[1] + size[2]);
total_size = size[0];
if (total_size > INT64_MAX - size[1])
return AVERROR_INVALIDDATA;
total_size += size[1];
if (total_size > INT64_MAX - size[2])
return AVERROR_INVALIDDATA;
total_size += size[2];
if (total_size > INT_MAX)
return AVERROR_INVALIDDATA;
res = av_new_packet(pkt, total_size);
if (res < 0) {
goto fail;
}