Commit d40c1b1281 for ffmpeg
commit d40c1b12811814fc6c2d0816527b003d8510ea06
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue Nov 3 01:22:44 2026 +0100
avcodec/cljrdec: check init_get_bits8() for failure
Fixes: CC4WYLNBQ75g
Fixes: AISLE-2026-0150-00062
Fixes: null pointer dereference
Null pointer dereference Replicated through UnModified FFmpeg with ASAN
(AVI file with one 2^28 byte CLJR frame)
Found-by: Joshua Rogers (AISLE)
diff --git a/libavcodec/cljrdec.c b/libavcodec/cljrdec.c
index 79fbea990f..ffd9f27e1a 100644
--- a/libavcodec/cljrdec.c
+++ b/libavcodec/cljrdec.c
@@ -51,7 +51,8 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *p,
if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
return ret;
- init_get_bits(&gb, buf, buf_size * 8);
+ if ((ret = init_get_bits8(&gb, buf, buf_size)) < 0)
+ return ret;
for (y = 0; y < avctx->height; y++) {
uint8_t *luma = &p->data[0][y * p->linesize[0]];