* [FFmpeg-devel] [PR] avformat/img2dec: Check avio_size() for failure (PR #21384)
@ 2026-01-05 17:12 michaelni via ffmpeg-devel
2026-01-05 22:38 ` [FFmpeg-devel] " Kieran Kunhya via ffmpeg-devel
0 siblings, 1 reply; 3+ messages in thread
From: michaelni via ffmpeg-devel @ 2026-01-05 17:12 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: michaelni
PR #21384 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21384
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21384.patch
More complete fix for #YWH-PGM40646-32
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
>From 1c214abfd52ac09cb5cb71de70e6475bb7f80747 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 5 Jan 2026 18:07:49 +0100
Subject: [PATCH] avformat/img2dec: Check avio_size() for failure
More complete fix for #YWH-PGM40646-32
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/img2dec.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c
index 586634c0c3..523015e4c6 100644
--- a/libavformat/img2dec.c
+++ b/libavformat/img2dec.c
@@ -367,7 +367,6 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
int i, res;
int ret[3] = { 0 };
int64_t size[3] = { 0 };
- int64_t total_size;
AVIOContext *f[3] = { NULL };
AVCodecParameters *par = s1->streams[0]->codecpar;
@@ -458,15 +457,15 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
}
}
- total_size = size[0];
- if (total_size > INT64_MAX - size[1])
- return AVERROR_INVALIDDATA;
- total_size += size[1];
- if (total_size > INT64_MAX - size[2])
- return AVERROR_INVALIDDATA;
- total_size += size[2];
- if (total_size > INT_MAX)
- return AVERROR_INVALIDDATA;
+ int64_t total_size = 0;
+ for(int i = 0; i < 3; i++) {
+ if (size[i] < 0)
+ return size[i];
+ if (total_size > INT64_MAX - size[i])
+ return AVERROR_INVALIDDATA;
+
+ total_size += size[i];
+ }
res = av_new_packet(pkt, total_size);
if (res < 0) {
--
2.49.1
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
^ permalink raw reply [flat|nested] 3+ messages in thread
* [FFmpeg-devel] Re: [PR] avformat/img2dec: Check avio_size() for failure (PR #21384)
2026-01-05 17:12 [FFmpeg-devel] [PR] avformat/img2dec: Check avio_size() for failure (PR #21384) michaelni via ffmpeg-devel
@ 2026-01-05 22:38 ` Kieran Kunhya via ffmpeg-devel
2026-01-08 2:52 ` Michael Niedermayer via ffmpeg-devel
0 siblings, 1 reply; 3+ messages in thread
From: Kieran Kunhya via ffmpeg-devel @ 2026-01-05 22:38 UTC (permalink / raw)
To: FFmpeg development discussions and patches; +Cc: michaelni, Kieran Kunhya
On Mon, Jan 5, 2026 at 5:12 PM michaelni via ffmpeg-devel
<ffmpeg-devel@ffmpeg.org> wrote:
>
> PR #21384 opened by michaelni
> URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21384
> Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21384.patch
>
> More complete fix for #YWH-PGM40646-32
>
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
>
>
> >From 1c214abfd52ac09cb5cb71de70e6475bb7f80747 Mon Sep 17 00:00:00 2001
> From: Michael Niedermayer <michael@niedermayer.cc>
> Date: Mon, 5 Jan 2026 18:07:49 +0100
> Subject: [PATCH] avformat/img2dec: Check avio_size() for failure
>
> More complete fix for #YWH-PGM40646-32
>
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavformat/img2dec.c | 19 +++++++++----------
> 1 file changed, 9 insertions(+), 10 deletions(-)
>
> diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c
> index 586634c0c3..523015e4c6 100644
> --- a/libavformat/img2dec.c
> +++ b/libavformat/img2dec.c
> @@ -367,7 +367,6 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
> int i, res;
> int ret[3] = { 0 };
> int64_t size[3] = { 0 };
> - int64_t total_size;
> AVIOContext *f[3] = { NULL };
> AVCodecParameters *par = s1->streams[0]->codecpar;
>
> @@ -458,15 +457,15 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
> }
> }
>
> - total_size = size[0];
> - if (total_size > INT64_MAX - size[1])
> - return AVERROR_INVALIDDATA;
> - total_size += size[1];
> - if (total_size > INT64_MAX - size[2])
> - return AVERROR_INVALIDDATA;
> - total_size += size[2];
> - if (total_size > INT_MAX)
> - return AVERROR_INVALIDDATA;
> + int64_t total_size = 0;
> + for(int i = 0; i < 3; i++) {
> + if (size[i] < 0)
> + return size[i];
> + if (total_size > INT64_MAX - size[i])
> + return AVERROR_INVALIDDATA;
> +
> + total_size += size[i];
> + }
Check for (total_size > INT_MAX) is gone now, is that intentional?
Kieran
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
^ permalink raw reply [flat|nested] 3+ messages in thread
* [FFmpeg-devel] Re: [PR] avformat/img2dec: Check avio_size() for failure (PR #21384)
2026-01-05 22:38 ` [FFmpeg-devel] " Kieran Kunhya via ffmpeg-devel
@ 2026-01-08 2:52 ` Michael Niedermayer via ffmpeg-devel
0 siblings, 0 replies; 3+ messages in thread
From: Michael Niedermayer via ffmpeg-devel @ 2026-01-08 2:52 UTC (permalink / raw)
To: FFmpeg development discussions and patches; +Cc: Michael Niedermayer
[-- Attachment #1.1: Type: text/plain, Size: 2546 bytes --]
Hi Kieran
On Mon, Jan 05, 2026 at 10:38:29PM +0000, Kieran Kunhya via ffmpeg-devel wrote:
> On Mon, Jan 5, 2026 at 5:12 PM michaelni via ffmpeg-devel
> <ffmpeg-devel@ffmpeg.org> wrote:
> >
> > PR #21384 opened by michaelni
> > URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21384
> > Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21384.patch
> >
> > More complete fix for #YWH-PGM40646-32
> >
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> >
> >
> > >From 1c214abfd52ac09cb5cb71de70e6475bb7f80747 Mon Sep 17 00:00:00 2001
> > From: Michael Niedermayer <michael@niedermayer.cc>
> > Date: Mon, 5 Jan 2026 18:07:49 +0100
> > Subject: [PATCH] avformat/img2dec: Check avio_size() for failure
> >
> > More complete fix for #YWH-PGM40646-32
> >
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> > libavformat/img2dec.c | 19 +++++++++----------
> > 1 file changed, 9 insertions(+), 10 deletions(-)
> >
> > diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c
> > index 586634c0c3..523015e4c6 100644
> > --- a/libavformat/img2dec.c
> > +++ b/libavformat/img2dec.c
> > @@ -367,7 +367,6 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
> > int i, res;
> > int ret[3] = { 0 };
> > int64_t size[3] = { 0 };
> > - int64_t total_size;
> > AVIOContext *f[3] = { NULL };
> > AVCodecParameters *par = s1->streams[0]->codecpar;
> >
> > @@ -458,15 +457,15 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt)
> > }
> > }
> >
> > - total_size = size[0];
> > - if (total_size > INT64_MAX - size[1])
> > - return AVERROR_INVALIDDATA;
> > - total_size += size[1];
> > - if (total_size > INT64_MAX - size[2])
> > - return AVERROR_INVALIDDATA;
> > - total_size += size[2];
> > - if (total_size > INT_MAX)
> > - return AVERROR_INVALIDDATA;
> > + int64_t total_size = 0;
> > + for(int i = 0; i < 3; i++) {
> > + if (size[i] < 0)
> > + return size[i];
> > + if (total_size > INT64_MAX - size[i])
> > + return AVERROR_INVALIDDATA;
> > +
> > + total_size += size[i];
> > + }
>
> Check for (total_size > INT_MAX) is gone now, is that intentional?
no
thx
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
Complexity theory is the science of finding the exact solution to an
approximation. Benchmarking OTOH is finding an approximation of the exact
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 163 bytes --]
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-01-08 2:53 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-01-05 17:12 [FFmpeg-devel] [PR] avformat/img2dec: Check avio_size() for failure (PR #21384) michaelni via ffmpeg-devel
2026-01-05 22:38 ` [FFmpeg-devel] " Kieran Kunhya via ffmpeg-devel
2026-01-08 2:52 ` Michael Niedermayer via ffmpeg-devel
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git