From 16daadeabbced8fc2aa467531d654bd3b0ad47bc Mon Sep 17 00:00:00 2001 From: zhorzhetta1404-ux Date: Mon, 17 Aug 2026 13:07:08 +0300 Subject: [PATCH] avformat/oggdec: check for integer overflow in buf_realloc In buf_realloc, os->bufsize is unsigned int and the code doubles it: nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE); When os->bufsize exceeds UINT_MAX/2, the multiplication overflows to a small value, av_realloc returns a tiny buffer, and the subsequent page write in ogg_read_page goes out of bounds. Reject the reallocation before the overflow can occur. The largest safe value is (UINT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 2. Signed-off-by: age5000 (cherry picked from commit d7d119bbe26c7e5c27a8b50fc8a25da43564c48a) Signed-off-by: Michael Niedermayer --- libavformat/oggdec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c index 48279f2928..2192ea5874 100644 --- a/libavformat/oggdec.c +++ b/libavformat/oggdec.c @@ -304,7 +304,10 @@ static int buf_realloc(struct ogg_stream *os, int size) { /* Even if invalid guarantee there's enough memory to read the page */ if (os->bufsize - os->bufpos < size) { - uint8_t *nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE); + uint8_t *nb; + if (os->bufsize > (UINT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 2) + return AVERROR(ENOMEM); + nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE); if (!nb) return AVERROR(ENOMEM); os->buf = nb;