Commit e723ebf0e2 for ffmpeg
commit e723ebf0e2f32c233f27f2f2e10ab579d345f593
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri Sep 25 05:28:36 2026 +0200
avutil/avsscanf: mask the ring buffer index when decfloat appends a zero digit group
Fixes: stack-buffer-underflow
Fixes: YrUfC4ZuDBNi
Fixes: ANT-2026-1B7JHPCG
Found-by: Anthropic agents; validated and reported by Ada Logics.
diff --git a/libavutil/avsscanf.c b/libavutil/avsscanf.c
index a0dfb20459..0a49295e76 100644
--- a/libavutil/avsscanf.c
+++ b/libavutil/avsscanf.c
@@ -438,7 +438,7 @@ static double decfloat(FFFILE *f, int c, int bits, int emin, int sign, int pok)
/* Assemble desired bits into floating point variable */
for (y=i=0; i<LD_B1B_DIG; i++) {
- if ((a+i & MASK)==z) x[(z=(z+1 & MASK))-1] = 0;
+ if ((a+i & MASK)==z) x[(z=(z+1 & MASK))-1 & MASK] = 0;
y = 1000000000.0L * y + x[a+i & MASK];
}