Commit 9b99973b2b for ffmpeg
commit 9b99973b2bbecee0b7e1e57035b95498b42f54a6
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon Nov 2 14:41:56 2026 +0100
avcodec/encode: reject video frames larger than the encoder too
Fixes: HXFS7VRNHzgr
Fixes: JN4xU8n5QSCA
Fixes: TDILTq5sYK4u
Fixes: AISLE-2026-0150-00805
Fixes: AISLE-2026-0150-00343
Fixes: AISLE-2026-0150-00596
Fixes: AISLE-2026-0150-00810
Fixes: out of array read
Out of array read Replicated through UnModified FFmpeg with ASAN, using
-noautoscale
Found-by: Joshua Rogers (AISLE)
The report described the VideoToolbox and QSV encoders and suggested
rejecting frames whose dimensions or format differ from the context. The
software encoders were found during triage of the report.
diff --git a/libavcodec/encode.c b/libavcodec/encode.c
index 82ea3aedbb..c84cd87826 100644
--- a/libavcodec/encode.c
+++ b/libavcodec/encode.c
@@ -524,7 +524,7 @@ static int encode_send_frame_internal(AVCodecContext *avctx, const AVFrame *src)
if (!(desc && desc->flags & AV_PIX_FMT_FLAG_HWACCEL) &&
(src->format != avctx->pix_fmt ||
- src->width < avctx->width || src->height < avctx->height)) {
+ src->width != avctx->width || src->height != avctx->height)) {
av_log(avctx, AV_LOG_ERROR, "Frame size or pixel format does not match the encoder\n");
return AVERROR(EINVAL);
}