From: James Almer via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>
To: ffmpeg-devel@ffmpeg.org
Cc: James Almer <code@ffmpeg.org>
Subject: [FFmpeg-devel] [PR] avcodec/vc1dec: check return values of all init_get_bits() calls (PR #21466)
Date: Wed, 14 Jan 2026 13:50:48 -0000
Message-ID: <176839864913.25.4347598417601066205@4457048688e7> (raw)
PR #21466 opened by James Almer (jamrial)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21466
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21466.patch
And replace them with init_get_bits8, to prevent integer overflows on huge values.
Fixes issue #21463.
>From 8883736fa0caa5df5745c4f54f9178a173f659a5 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Wed, 14 Jan 2026 10:48:42 -0300
Subject: [PATCH] avcodec/vc1dec: check return values of all init_get_bits()
calls
And replace them with init_get_bits8, to prevent integer overflows on huge
values.
Fixes issue #21463.
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavcodec/vc1dec.c | 37 ++++++++++++++++++++++++++++---------
1 file changed, 28 insertions(+), 9 deletions(-)
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index 72bc810ce7..6bf3a7aa9b 100644
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -683,7 +683,11 @@ static av_cold int vc1_decode_init(AVCodecContext *avctx)
if (size <= 0)
continue;
buf2_size = v->vc1dsp.vc1_unescape_buffer(start + 4, size, buf2);
- init_get_bits(&gb, buf2, buf2_size * 8);
+ ret = init_get_bits8(&gb, buf2, buf2_size);
+ if (ret < 0) {
+ av_free(buf2);
+ return ret;
+ }
switch (AV_RB32(start)) {
case VC1_CODE_SEQHDR:
if ((ret = ff_vc1_decode_sequence_header(avctx, v, &gb)) < 0) {
@@ -888,8 +892,11 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
}
buf_size3 = v->vc1dsp.vc1_unescape_buffer(start + 4, size,
slices[n_slices].buf);
- init_get_bits(&slices[n_slices].gb, slices[n_slices].buf,
- buf_size3 << 3);
+ ret = init_get_bits8(&slices[n_slices].gb, slices[n_slices].buf, buf_size3);
+ if (ret < 0) {
+ ret = AVERROR(ENOMEM);
+ goto err;
+ }
slices[n_slices].mby_start = avctx->coded_height + 31 >> 5;
slices[n_slices].rawbuf = start;
slices[n_slices].raw_size = size + 4;
@@ -899,7 +906,11 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
}
case VC1_CODE_ENTRYPOINT: /* it should be before frame data */
buf_size2 = v->vc1dsp.vc1_unescape_buffer(start + 4, size, buf2);
- init_get_bits(&v->gb, buf2, buf_size2 * 8);
+ ret = init_get_bits8(&v->gb, buf2, buf_size2);
+ if (ret < 0) {
+ ret = AVERROR(ENOMEM);
+ goto err;
+ }
ff_vc1_decode_entry_point(avctx, v, &v->gb);
break;
case VC1_CODE_SLICE: {
@@ -918,8 +929,11 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
}
buf_size3 = v->vc1dsp.vc1_unescape_buffer(start + 4, size,
slices[n_slices].buf);
- init_get_bits(&slices[n_slices].gb, slices[n_slices].buf,
- buf_size3 << 3);
+ ret = init_get_bits8(&slices[n_slices].gb, slices[n_slices].buf, buf_size3);
+ if (ret < 0) {
+ ret = AVERROR(ENOMEM);
+ goto err;
+ }
slices[n_slices].mby_start = get_bits(&slices[n_slices].gb, 9);
slices[n_slices].rawbuf = start;
slices[n_slices].raw_size = size + 4;
@@ -952,8 +966,11 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
goto err;
}
buf_size3 = v->vc1dsp.vc1_unescape_buffer(divider + 4, buf + buf_size - divider - 4, slices[n_slices].buf);
- init_get_bits(&slices[n_slices].gb, slices[n_slices].buf,
- buf_size3 << 3);
+ ret = init_get_bits8(&slices[n_slices].gb, slices[n_slices].buf, buf_size3);
+ if (ret < 0) {
+ ret = AVERROR(ENOMEM);
+ goto err;
+ }
slices[n_slices].mby_start = s->mb_height + 1 >> 1;
slices[n_slices].rawbuf = divider;
slices[n_slices].raw_size = buf + buf_size - divider;
@@ -964,7 +981,9 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
} else {
buf_size2 = v->vc1dsp.vc1_unescape_buffer(buf, buf_size, buf2);
}
- init_get_bits(&v->gb, buf2, buf_size2*8);
+ ret = init_get_bits8(&v->gb, buf2, buf_size2);
+ if (ret < 0)
+ return ret;
} else{
ret = init_get_bits8(&v->gb, buf, buf_size);
if (ret < 0)
--
2.49.1
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
reply other threads:[~2026-01-14 13:51 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=176839864913.25.4347598417601066205@4457048688e7 \
--to=ffmpeg-devel@ffmpeg.org \
--cc=code@ffmpeg.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git