From efd6f75cfcc3f5d74537db793e3ca77887df54aa Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 31 Oct 2025 23:31:40 +0100 Subject: [PATCH] avcodec/mediacodecdec_common: Check that the input to mediacodec_wrap_sw_audio_buffer() contains channel * sample_size Fixes: out of array access no testcase Found-by: Joshua Rogers with ZeroPath Reviewed-by: Joshua Rogers Signed-off-by: Michael Niedermayer (cherry picked from commit 41a9c6ec5f75d8737da3e38223b8c4e923703401) Signed-off-by: Michael Niedermayer --- libavcodec/mediacodecdec_common.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/mediacodecdec_common.c b/libavcodec/mediacodecdec_common.c index 8a270f2f29..842a7d2bba 100644 --- a/libavcodec/mediacodecdec_common.c +++ b/libavcodec/mediacodecdec_common.c @@ -385,6 +385,12 @@ static int mediacodec_wrap_sw_audio_buffer(AVCodecContext *avctx, goto done; } + if (info->size % (sample_size * avctx->ch_layout.nb_channels)) { + av_log(avctx, AV_LOG_ERROR, "input is not a multiple of channels * sample_size\n"); + ret = AVERROR(EINVAL); + goto done; + } + frame->format = avctx->sample_fmt; frame->sample_rate = avctx->sample_rate; frame->nb_samples = info->size / (sample_size * avctx->ch_layout.nb_channels);