Commit 45f98d0819 for ffmpeg
commit 45f98d0819efe2b7ce93e9034b7e6a4ed6700621
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat Oct 24 06:38:34 2026 +0200
avcodec/huffyuvenc: reject frames too small for the median predictor
SEGV Replicated through UnModified FFmpeg with ASAN (width 2)
Out of array read Replicated through API with ASAN (heights 1 and 2)
Fixes: out of array access
Fixes: m5jVlJdov0Lp
Fixes: AISLE-2026-0150-00558
Found-by: Joshua Rogers (AISLE)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
diff --git a/libavcodec/huffyuvenc.c b/libavcodec/huffyuvenc.c
index 9aec2cc462..c9fd80b838 100644
--- a/libavcodec/huffyuvenc.c
+++ b/libavcodec/huffyuvenc.c
@@ -370,6 +370,13 @@ static av_cold int encode_init(AVCodecContext *avctx)
return AVERROR(EINVAL);
}
+ if (s->predictor == MEDIAN && s->version <= 2 &&
+ (avctx->width < 4 ||
+ AV_CEIL_RSHIFT(avctx->height, s->chroma_v_shift) < 2 + s->interlaced)) {
+ av_log(avctx, AV_LOG_ERROR, "Frame too small for the median predictor\n");
+ return AVERROR(EINVAL);
+ }
+
avctx->extradata[0] = s->predictor | (s->decorrelate << 6);
avctx->extradata[2] = s->interlaced ? 0x10 : 0x20;
if (s->context)