diff mbox series

[FFmpeg-devel,PR] avcodec/cook: reject js_subband_start beyond subbands (PR #24763)

Message ID 20260929031438.7CAC92C9FB@ffbox0-bg.ffmpeg.org
State New
Headers
Series [FFmpeg-devel,PR] avcodec/cook: reject js_subband_start beyond subbands (PR #24763) |

Commit Message

ffmpeg-devel Sept. 29, 2026, 3:14 a.m. UTC 
PR #24763 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24763
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24763.patch

Fixes: information leak of heap pointers and decoder state into the output
Fixes: qhg9vxxyEOy1
Found-by: Yuyao Jiang
Replicated through Modified FFmpeg



>From 19961fc8823294918a5019868362b4ae4691d025 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 29 Sep 2026 01:57:32 +0200
Subject: [PATCH] avcodec/cook: reject js_subband_start beyond subbands

Fixes: information leak of heap pointers and decoder state into the output
Fixes: qhg9vxxyEOy1
Found-by: Yuyao Jiang
Replicated through Modified FFmpeg
---
 libavcodec/cook.c | 7 +++++++
 1 file changed, 7 insertions(+)
diff mbox series

Patch

diff --git a/libavcodec/cook.c b/libavcodec/cook.c
index 5ed3d2596b..71c2409ad3 100644
--- a/libavcodec/cook.c
+++ b/libavcodec/cook.c
@@ -1218,6 +1218,13 @@  static av_cold int cook_decode_init(AVCodecContext *avctx)
             return AVERROR_PATCHWELCOME;
         }
 
+        if (q->subpacket[s].joint_stereo &&
+            q->subpacket[s].js_subband_start > q->subpacket[s].subbands) {
+            av_log(avctx, AV_LOG_ERROR, "js_subband_start %d > subbands %d\n",
+                   q->subpacket[s].js_subband_start, q->subpacket[s].subbands);
+            return AVERROR_INVALIDDATA;
+        }
+
         if ((q->subpacket[s].js_vlc_bits > 6) ||
             (q->subpacket[s].js_vlc_bits < 2 * q->subpacket[s].joint_stereo)) {
             av_log(avctx, AV_LOG_ERROR, "js_vlc_bits = %d, only >= %d and <= 6 allowed!\n",