Commit 5d7b743bdf for ffmpeg
commit 5d7b743bdfb724df21fd43a3d7f3258382eb578c
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue Nov 3 01:22:43 2026 +0100
avcodec/eatqi: check init_get_bits8() for failure
Fixes: 8DIglq00jxSy
Fixes: AISLE-2026-0150-00271
Fixes: null pointer dereference
Null pointer dereference Replicated through UnModified FFmpeg with ASAN
(EA file with a pIQT chunk carrying a 2^28 byte payload)
Found-by: Joshua Rogers (AISLE)
diff --git a/libavcodec/eatqi.c b/libavcodec/eatqi.c
index 421ed51009..3249ef3e0e 100644
--- a/libavcodec/eatqi.c
+++ b/libavcodec/eatqi.c
@@ -151,7 +151,9 @@ static int tqi_decode_frame(AVCodecContext *avctx, AVFrame *frame,
return AVERROR(ENOMEM);
t->bsdsp.bswap_buf(t->bitstream_buf, (const uint32_t *) buf,
(buf_end - buf) / 4);
- init_get_bits(&t->gb, t->bitstream_buf, 8 * (buf_end - buf));
+ ret = init_get_bits8(&t->gb, t->bitstream_buf, buf_end - buf);
+ if (ret < 0)
+ return ret;
t->last_dc[0] =
t->last_dc[1] =