sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-28 15:19:38 +03:00
Code Activity

avformat/oggdec: check for integer overflow in buf_realloc

Browse Source 
In buf_realloc, os->bufsize is unsigned int and the code doubles it:
    nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE);

When os->bufsize exceeds UINT_MAX/2, the multiplication overflows
to a small value, av_realloc returns a tiny buffer, and the subsequent
page write in ogg_read_page goes out of bounds.

Reject the reallocation before the overflow can occur. The largest
safe value is (UINT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 2.

Signed-off-by: age5000 <age5000@proton.me>
(cherry picked from commit d7d119bbe2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
zhorzhetta1404-ux
2026-08-17 13:07:08 +03:00
committed by Michael Niedermayer
parent 2986e0678e
commit 16daadeabb
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libavformat/oggdec.c
View File

@@ -304,7 +304,10 @@ static int buf_realloc(struct ogg_stream *os, int size)
{
/* Even if invalid guarantee there's enough memory to read the page */
if (os->bufsize - os->bufpos < size) {
uint8_t *nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE);
uint8_t *nb;
if (os->bufsize > (UINT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 2)
return AVERROR(ENOMEM);
nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE);
if (!nb)
return AVERROR(ENOMEM);
os->buf = nb;