From ffff6c014652dc2fe9f348229a413788734255e0 Mon Sep 17 00:00:00 2001 From: tabudz Date: Sun, 8 Mar 2026 22:22:00 +0800 Subject: [PATCH] avformat/asfdec_o: Check size_bmp more fully Fixes: integer overflow and out of array access Fixes: asfo-crash-46080c4341572a7137a162331af77f6ded45cbd7 Found-by: Paul Ch Signed-off-by: Michael Niedermayer --- 3rdparty/ffmpeg/libavformat/asfdec_o.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/3rdparty/ffmpeg/libavformat/asfdec_o.c b/3rdparty/ffmpeg/libavformat/asfdec_o.c index 2320c661..1967bd11 100644 --- a/3rdparty/ffmpeg/libavformat/asfdec_o.c +++ b/3rdparty/ffmpeg/libavformat/asfdec_o.c @@ -703,7 +703,8 @@ static int parse_video_info(AVIOContext *pb, AVStream *st) st->codec->codec_tag = tag; st->codec->codec_id = ff_codec_get_id(ff_codec_bmp_tags, tag); - if (size > BMP_HEADER_SIZE) { + if (size > BMP_HEADER_SIZE && + size < INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) { int ret; st->codec->extradata_size = size - BMP_HEADER_SIZE; if (!(st->codec->extradata = av_malloc(st->codec->extradata_size +