From 254cebc4e8e1358ffcf7ba6fc13bcc4a98db80de Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 12 Oct 2026 04:01:02 +0200 Subject: [PATCH] avcodec/encode: reject video frames that do not match the encoder Fixes: out of array read Fixes: DdI1HfjoEG1l Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24765 Out of array read Replicated through UnModified FFmpeg with ASAN --- libavcodec/encode.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/libavcodec/encode.c b/libavcodec/encode.c index 6fbbe86d8f..fd503f01e1 100644 --- a/libavcodec/encode.c +++ b/libavcodec/encode.c @@ -518,6 +518,15 @@ static int encode_send_frame_internal(AVCodecContext *avctx, const AVFrame *src) } } } + } else if (!(avctx->codec->capabilities & AV_CODEC_CAP_PARAM_CHANGE)) { + const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(src->format); + + if (!(desc && desc->flags & AV_PIX_FMT_FLAG_HWACCEL) && + (src->format != avctx->pix_fmt || + src->width < avctx->width || src->height < avctx->height)) { + av_log(avctx, AV_LOG_ERROR, "Frame size or pixel format does not match the encoder\n"); + return AVERROR(EINVAL); + } } ret = av_frame_ref(dst, src);