Commit 7db5047104 for ffmpeg
commit 7db504710419fb8b83d80b8d791089dcd6f2aefa
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue Oct 6 06:51:47 2026 +0200
avformat/omadec: Repeat the key bytes from the padded key copy in kset()
Fixes: out of array read
Fixes: f3cEzuDEDwTL
Fixes: AISLE-2026-0111-00258
Out of array read Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
diff --git a/libavformat/omadec.c b/libavformat/omadec.c
index 552a37df18..6c034b1a1a 100644
--- a/libavformat/omadec.c
+++ b/libavformat/omadec.c
@@ -126,14 +126,14 @@ static int kset(AVFormatContext *s, const uint8_t *r_val, const uint8_t *n_val,
memset(oc->r_val, 0, 24);
memcpy(oc->r_val, r_val, len);
}
- memcpy(&oc->r_val[16], r_val, 8);
+ memcpy(&oc->r_val[16], oc->r_val, 8);
}
if (n_val) {
if (n_val != oc->n_val) {
memset(oc->n_val, 0, 24);
memcpy(oc->n_val, n_val, len);
}
- memcpy(&oc->n_val[16], n_val, 8);
+ memcpy(&oc->n_val[16], oc->n_val, 8);
}
return 0;