[FFmpeg-cvslog] [ffmpeg] branch master updated. c9e93df4ee avcodec/prores_raw: Fix heap buffer overflow

[ffmpeg-git at ffmpeg.org]

The branch, master has been updated
       via  c9e93df4eed93fe0044c52d953688c4180de1d48 (commit)
      from  ac5303a5b9cdc17e4ebddfdc3203a4c325d42c52 (commit)


- Log -----------------------------------------------------------------
commit c9e93df4eed93fe0044c52d953688c4180de1d48
Author:     Oliver Chang <ochang at google.com>
AuthorDate: Thu Aug 14 22:11:41 2025 -0700
Commit:     Lynne <dev at lynne.ee>
CommitDate: Fri Aug 15 15:06:58 2025 +0000

    avcodec/prores_raw: Fix heap buffer overflow
    
    When dimensions differ from context, those were updated using
    ff_set_dimensions, however this overwrote the aligned coded_width and
    coded_height that were set before, leading to a buffer overflow when
    writing the frame data.
    
    Fixes: OssFuzz 438771336
    Fixes: Heap-buffer-overflow
    
    Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
    Signed-off-by: Marvin Scholz <epirat07 at gmail.com>
    Reviewed-by: Marvin Scholz <epirat07 at gmail.com>

diff --git a/libavcodec/prores_raw.c b/libavcodec/prores_raw.c
index 748e176815..b2aa97ddda 100644
--- a/libavcodec/prores_raw.c
+++ b/libavcodec/prores_raw.c
@@ -367,9 +367,6 @@ static int decode_frame(AVCodecContext *avctx,
     if ((w & 1) || (h & 1))
         return AVERROR_INVALIDDATA;
 
-    avctx->coded_width  = FFALIGN(w, 16);
-    avctx->coded_height = FFALIGN(h, 16);
-
     if (w != avctx->width || h != avctx->height) {
         av_log(avctx, AV_LOG_WARNING, "picture resolution change: %ix%i -> %ix%i\n",
                avctx->width, avctx->height, w, h);
@@ -377,6 +374,9 @@ static int decode_frame(AVCodecContext *avctx,
             return ret;
     }
 
+    avctx->coded_width  = FFALIGN(w, 16);
+    avctx->coded_height = FFALIGN(h, 16);
+
     enum AVPixelFormat pix_fmt = AV_PIX_FMT_BAYER_RGGB16;
     if (pix_fmt != s->pix_fmt) {
         s->pix_fmt = pix_fmt;

-----------------------------------------------------------------------

Summary of changes:
 libavcodec/prores_raw.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)


hooks/post-receive
--