Commit 468a9de816 for ffmpeg
commit 468a9de816a38fd0e04d9f5c8303395a5f36a0b8
Author: Kacper Michajłow <kasper93@gmail.com>
Date: Thu Oct 29 22:51:19 2026 +0100
avcodec/hdrdec: avoid an integer overflow in the input size check
Fixes: signed integer overflow: 701411834 * 4 cannot be represented in type 'int'
Fixes: 536328675/clusterfuzz-testcase-minimized-fuzzer_loadfile-4748225916239872
Found-by: https://github.com/google/oss-fuzz/tree/master/projects/mpv
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c
index 7f3b830b6d..a74848eee5 100644
--- a/libavcodec/hdrdec.c
+++ b/libavcodec/hdrdec.c
@@ -126,7 +126,7 @@ static int hdr_decode_frame(AVCodecContext *avctx, AVFrame *p,
;
}
- if (bytestream2_get_bytes_left(&gb) < height * 4)
+ if (bytestream2_get_bytes_left(&gb) < height * 4LL)
return AVERROR_INVALIDDATA;
if ((ret = ff_set_dimensions(avctx, width, height)) < 0)