Change #250826

Comments

libavcodec/prores_raw: Fix heap-buffer-overflow in decode_frame
Fixes a heap-buffer-overflow in `decode_frame` where `header_len` read
from the bitstream was not validated against the remaining bytes in the
input buffer (`gb`). This allowed `gb_hdr` to be initialized with a size
exceeding the actual packet data, leading to an out-of-bounds read.

The fix adds a check to ensure `bytestream2_get_bytes_left(&gb)` is
greater than or equal to `header_len - 2` before initializing `gb_hdr`.

Fixes: https://issues.oss-fuzz.com/issues/439711053

Changed files

• libavcodec/prores_raw.c