Commit fa4daf630e for ffmpeg

commit fa4daf630eb52235b1b3d0e9b1cc08392b87e9a8
Author: lusoris <lusoris@proton.me>
Date:   Thu Oct 15 22:06:35 2026 +0200

    avcodec/rv60dec: validate angular prediction buffer bounds

    GCC 14.4.0 and 16.2.1 report -Wstringop-overflow in angular prediction.
    Unchecked block sizes and derived filter lengths could exceed the local
    reference buffer. Require a power-of-two size from 4 to 64 and bound the
    weak and bilinear filter lengths before writing. Prediction is unchanged
    for sizes and lengths within those bounds.

    Signed-off-by: lusoris <lusoris@proton.me>

diff --git a/libavcodec/rv60dec.c b/libavcodec/rv60dec.c
index 2a7c5c1147..555e1b8081 100644
--- a/libavcodec/rv60dec.c
+++ b/libavcodec/rv60dec.c
@@ -662,6 +662,9 @@ static int pred_angle(const IntraPredContext * p, uint8_t * dst, int stride, int
 {
     uint8_t filtered1[96], filtered2[96];

+    if (size < 4 || size > 64 || (size & (size - 1)))
+        return AVERROR_INVALIDDATA;
+
     if (!imode) {
         pred_plane(p, dst, stride, size);
     } else if (imode == 1) {
@@ -670,8 +673,13 @@ static int pred_angle(const IntraPredContext * p, uint8_t * dst, int stride, int
         int ang_weight = rv60_ipred_angle[10 - imode];
         int add_size = (size * ang_weight + 31) >> 5;
         if (size <= 16) {
-            filter_weak(filtered1 + 32, &p->l[1], size + add_size);
+            const int filtered_size = size + add_size;
+            if (filtered_size < 1 || filtered_size > 64)
+                return AVERROR_INVALIDDATA;
+            filter_weak(filtered1 + 32, &p->l[1], filtered_size);
         } else {
+            if (add_size < 0 || add_size > 32)
+                return AVERROR_INVALIDDATA;
             filter_bilin32(filtered1 + 32, p->l[1], p->l[33], 32);
             filter_bilin32(filtered1 + 64, p->l[32], p->l[64], add_size);
         }
@@ -746,9 +754,14 @@ static int pred_angle(const IntraPredContext * p, uint8_t * dst, int stride, int
     } else if (imode <= 34) {
         int ang_weight = rv60_ipred_angle[imode - 26];
         int add_size = (size * ang_weight + 31) >> 5;
-        if (size <= 16)
-            filter_weak(&filtered1[32], &p->t[1], size + add_size);
-        else {
+        if (size <= 16) {
+            const int filtered_size = size + add_size;
+            if (filtered_size < 1 || filtered_size > 64)
+                return AVERROR_INVALIDDATA;
+            filter_weak(&filtered1[32], &p->t[1], filtered_size);
+        } else {
+            if (add_size < 0 || add_size > 32)
+                return AVERROR_INVALIDDATA;
             filter_bilin32(filtered1 + 32, p->t[1], p->t[33], 32);
             filter_bilin32(filtered1 + 64, p->t[32], p->t[64], add_size);
         }