Commit 9691e4fde6 for ffmpeg
commit 9691e4fde64e14de73c298562c4e475f9412b5ad
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue Nov 3 01:22:44 2026 +0100
avcodec/eatgv: check init_get_bits8() for failure
Fixes: q0AsSZJdP8Nm
Fixes: AISLE-2026-0150-00052
Fixes: null pointer dereference
Null pointer dereference Replicated through UnModified FFmpeg with ASAN
(EA file with a kVGT frame followed by an fVGT frame whose compressed block
section is 2^28 bytes)
Found-by: Joshua Rogers (AISLE)
diff --git a/libavcodec/eatgv.c b/libavcodec/eatgv.c
index 35bd88b740..d71a0c6f93 100644
--- a/libavcodec/eatgv.c
+++ b/libavcodec/eatgv.c
@@ -209,7 +209,9 @@ static int tgv_decode_inter(TgvContext *s, AVFrame *frame,
buf += num_blocks_raw * 16;
/* read compressed blocks */
- init_get_bits(&gb, buf, (buf_end - buf) << 3);
+ int ret = init_get_bits8(&gb, buf, buf_end - buf);
+ if (ret < 0)
+ return ret;
for (i = 0; i < num_blocks_packed; i++) {
int tmp[4];
for (j = 0; j < 4; j++)