Commit f1a000d41f for ffmpeg
commit f1a000d41f3b5de2c305b5abb6e2718d070fedcc
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri Sep 25 04:16:19 2026 +0200
avcodec/mpeg12dec: reject a picture in the extradata
Fixes: heap-buffer-overflow (write)
Fixes: K5p3oItPlfin
Fixes: ANT-2026-JWL71YJC-poc.avi
Found-by: Claude and Ada Logics
diff --git a/libavcodec/mpeg12dec.c b/libavcodec/mpeg12dec.c
index bef003704a..e30fa843cc 100644
--- a/libavcodec/mpeg12dec.c
+++ b/libavcodec/mpeg12dec.c
@@ -2298,6 +2298,8 @@ static int decode_chunks(AVCodecContext *avctx, AVFrame *picture,
av_log(avctx, AV_LOG_WARNING, "ignoring picture start code in AVmp extradata\n");
break;
}
+ if (buf == avctx->extradata)
+ return AVERROR_INVALIDDATA;
if (s2->width <= 0 || s2->height <= 0) {
av_log(avctx, AV_LOG_ERROR, "Invalid frame dimensions %dx%d.\n",