From 59f8cfd66d6c102e398a962b3cb64241d24a7239 Mon Sep 17 00:00:00 2001 From: chenzhu Date: Mon, 29 Jun 2026 16:11:10 +0800 Subject: [PATCH] Fix CVE-2026-8461 in magicyuv decoder (upstream #23159) --- libavcodec/magicyuv.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/libavcodec/magicyuv.c b/libavcodec/magicyuv.c index 13cb346119..ea18920fe8 100644 --- a/libavcodec/magicyuv.c +++ b/libavcodec/magicyuv.c @@ -210,7 +210,8 @@ static int magy_decode_slice10(AVCodecContext *avctx, void *tdata, s->llviddsp.add_left_pred_int16(dst, dst, max, width, 0); dst += stride; } - lefttop = left = dst[0]; + if (1 + interlaced < height) + lefttop = left = dst[0]; for (k = 1 + interlaced; k < height; k++) { magicyuv_median_pred16(dst, dst - fake_stride, dst, width, &left, &lefttop, max); lefttop = left = dst[0]; @@ -569,6 +570,13 @@ static int magy_decode_frame(AVCodecContext *avctx, void *data, "invalid slice height: %d\n", s->slice_height); return AVERROR_INVALIDDATA; } + if (s->vshift[1] && (s->slice_height & ((1 << s->vshift[1]) - 1))) { + av_log(avctx, AV_LOG_ERROR, + "slice_height %d is not aligned to chroma vertical " + "subsampling (must be a multiple of %d)\n", + s->slice_height, 1 << s->vshift[1]); + return AVERROR_INVALIDDATA; + } bytestream2_skipu(&gb, 4); @@ -579,11 +587,11 @@ static int magy_decode_frame(AVCodecContext *avctx, void *data, return AVERROR_INVALIDDATA; } + if ((s->slice_height >> s->vshift[1]) <= s->interlaced) { + av_log(avctx, AV_LOG_ERROR, "impossible slice height\n"); + return AVERROR_INVALIDDATA; + } if (s->interlaced) { - if ((s->slice_height >> s->vshift[1]) < 2) { - av_log(avctx, AV_LOG_ERROR, "impossible slice height\n"); - return AVERROR_INVALIDDATA; - } if ((avctx->coded_height % s->slice_height) && ((avctx->coded_height % s->slice_height) >> s->vshift[1]) < 2) { av_log(avctx, AV_LOG_ERROR, "impossible height\n"); return AVERROR_INVALIDDATA;