[PR] avformat/oggdec: check for integer overflow in buf_realloc (PR #24178)

PR #24178 opened by myage5000
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24178
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24178.patch

In buf_realloc, os->bufsize is unsigned int and the code doubles it:
    nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE);

When os->bufsize exceeds UINT_MAX/2, the multiplication overflows
to a small value, av_realloc returns a tiny buffer, and the subsequent
page write in ogg_read_page goes out of bounds.

Reject the reallocation before the overflow can occur.

Signed-off-by: age5000 <[email protected]>

# Summary of changes

Briefly describe what this PR does and why.

<!--
If this PR requires new FATE test samples, attach them to the PR and
list their target paths below (relative to the fate-suite root).

Attached filenames must match the sample's filename:

```fate-samples
# e.g. vorbis/new-sample.ogg
```
-->



>From eabc00832180dddd19c91d421035321c6d2fb77e Mon Sep 17 00:00:00 2001
From: zhorzhetta1404-ux <[email protected]>
Date: Mon, 17 Aug 2026 13:07:08 +0300
Subject: [PATCH] avformat/oggdec: check for integer overflow in buf_realloc

In buf_realloc, os->bufsize is unsigned int and the code doubles it:
    nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE);

When os->bufsize exceeds UINT_MAX/2, the multiplication overflows
to a small value, av_realloc returns a tiny buffer, and the subsequent
page write in ogg_read_page goes out of bounds.

Reject the reallocation before the overflow can occur.

Signed-off-by: age5000 <[email protected]>
---
 libavformat/oggdec.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c
index 1f8f78e369..ffa72909f1 100644
--- a/libavformat/oggdec.c
+++ b/libavformat/oggdec.c
@@ -304,7 +304,10 @@ static int buf_realloc(struct ogg_stream *os, int size)
 {
     /* Even if invalid guarantee there's enough memory to read the page */
     if (os->bufsize - os->bufpos < size) {
-        uint8_t *nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE);
+        uint8_t *nb;
+        if (os->bufsize > UINT_MAX / 2)
+            return AVERROR(ENOMEM);
+        nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE);
         if (!nb)
             return AVERROR(ENOMEM);
         os->buf = nb;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]