projects / ffmpeg.git / commitdiff
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 9228127)
avcodec/hevc/ps: Check window parameters
authorMichael Niedermayer <michael@niedermayer.cc>
Sun, 22 Feb 2026 20:51:01 +0000 (21:51 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Thu, 18 Jun 2026 18:31:02 +0000 (20:31 +0200)
Fixes: signed integer overflow: -1094995529 * 2 cannot be represented in type 'int'
Fixes: 484567435/clusterfuzz-testcase-minimized-ffmpeg_dem_HXVS_fuzzer-5628836988649472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 82f097c825237219557a14918b74fa254121a6de)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/hevc/ps.c patch | blob | history

diff --git a/libavcodec/hevc/ps.c b/libavcodec/hevc/ps.c
index 7b2ea0d87b0735075ef8d19f5362a6e8d3210b8e..c088ab185b67ff70b23f08a752176506049cc8d5 100644 (file)
--- a/libavcodec/hevc/ps.c
+++ b/libavcodec/hevc/ps.c
@@ -71,6 +71,13 @@ static int read_window(HEVCWindow *window, GetBitContext *gb, int chroma_format_
     int64_t top    = get_ue_golomb_long(gb) * vert_mult;
     int64_t bottom = get_ue_golomb_long(gb) * vert_mult;
 
+    if (left < 0 || right < 0 || top < 0 || bottom < 0 ||
+        w <= left + right ||
+        h <= top + bottom) {
+        memset(window, 0, sizeof(*window));
+        return AVERROR_INVALIDDATA;
+    }
+
     window->left_offset   = left;
     window->right_offset  = right;
     window->top_offset    = top;
FFmpeg git repo