From f7745d071ba5b7164bb06c22322dcfd278e384da Mon Sep 17 00:00:00 2001 From: Stanislav Fort Date: Tue, 28 Oct 2025 16:46:49 +0100 Subject: [PATCH] oggspots: fix OOB read (unchecked image offset) Fixes #29319 --- modules/codec/oggspots.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/codec/oggspots.c b/modules/codec/oggspots.c index 5970f24abc..0da20e359d 100644 --- a/modules/codec/oggspots.c +++ b/modules/codec/oggspots.c @@ -354,6 +354,12 @@ static picture_t* DecodePacket(decoder_t* p_dec, block_t* p_block) goto error; } + if (i_img_offset > p_block->i_buffer) { + msg_Dbg(p_dec, "Invalid byte offset: %u exceeds packet size %zu", + i_img_offset, p_block->i_buffer); + goto error; + } + /* Image format */ if ( !memcmp(&p_block->p_buffer[4], "PNG", 3) ) { p_dec->fmt_in.video.i_chroma = VLC_CODEC_PNG;