[PR] avcodec/mace: reject sample counts that overflow int (PR #23631)

PR #23631 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631.patch

Fixes: heap buffer overflow
Fixes: FmXBI2dbgvgD
Fixes: 0eea212943544d40f99b05571aa7159d78667154 (Add avcodec_decode_audio4().)
Found-by: Adrian Junge (vurlo)
Signed-off-by: Michael Niedermayer <[email protected]>



>From 0e1e457a7e675e06d82a36a61f7b6adfeef469a2 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Mon, 29 Jun 2026 01:16:44 +0200
Subject: [PATCH] avcodec/mace: reject sample counts that overflow int

Fixes: heap buffer overflow
Fixes: FmXBI2dbgvgD
Fixes: 0eea212943544d40f99b05571aa7159d78667154 (Add avcodec_decode_audio4().)
Found-by: Adrian Junge (vurlo)
Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavcodec/mace.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavcodec/mace.c b/libavcodec/mace.c
index 299e5f5cfe..87e802684a 100644
--- a/libavcodec/mace.c
+++ b/libavcodec/mace.c
@@ -252,7 +252,10 @@ static int mace_decode_frame(AVCodecContext *avctx, AVFrame *frame,
     }
 
     /* get output buffer */
-    frame->nb_samples = 3 * (buf_size << (1 - is_mace3)) / channels;
+    int64_t nb_samples = 3 * ((int64_t)buf_size << (1 - is_mace3)) / channels;
+    if (nb_samples > INT_MAX)
+        return AVERROR_INVALIDDATA;
+    frame->nb_samples = nb_samples;
     if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
         return ret;
     samples = (int16_t **)frame->extended_data;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]