Commit f2e94c3eba for ffmpeg
commit f2e94c3ebaf04c7cb55d3ea5e5b13d3600a5eec3
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri Oct 16 23:19:11 2026 +0200
avcodec/ffv1enc_vulkan: reject frames whose float remap data exceeds 4 GiB
Fixes: UfNaupCjUEh6
Fixes: AISLE-2026-0150-00707
Integer overflow Replicated through Modified FFmpeg printing the sizes
Found-by: Joshua Rogers (AISLE)
The report suggested rejecting slice layouts whose remap data exceeds the
32 bit limit.
diff --git a/libavcodec/ffv1enc_vulkan.c b/libavcodec/ffv1enc_vulkan.c
index 699df37b6d..f3ded3d097 100644
--- a/libavcodec/ffv1enc_vulkan.c
+++ b/libavcodec/ffv1enc_vulkan.c
@@ -1362,6 +1362,11 @@ static av_cold int vulkan_encode_ffv1_init(AVCodecContext *avctx)
if (n < 2)
n = 2;
fv->max_pixels_per_slice = n;
+
+ if ((uint64_t)n * 12 * sizeof(uint32_t) * f->max_slice_count > UINT32_MAX) {
+ av_log(avctx, AV_LOG_ERROR, "Frame too large for the float remap\n");
+ return AVERROR_PATCHWELCOME;
+ }
}
/* Init rct search shader */