From d30dead35e7fecae51ccd4602273153c87b1bbd9 Mon Sep 17 00:00:00 2001 From: David Korczynski Date: Sat, 6 Jun 2026 16:23:27 +0200 Subject: [PATCH] avcodec/truespeech: reject iterations count whose * 240 product overflows 32-bit Found-by: Anthropic agents; validated and reported by Ada Logics. Signed-off-by: David Korczynski Signed-off-by: Michael Niedermayer --- libavcodec/truespeech.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/truespeech.c b/libavcodec/truespeech.c index 454121cc75..1c1b4057a2 100644 --- a/libavcodec/truespeech.c +++ b/libavcodec/truespeech.c @@ -323,6 +323,11 @@ static int truespeech_decode_frame(AVCodecContext *avctx, AVFrame *frame, "Too small input buffer (%d bytes), need at least 32 bytes\n", buf_size); return -1; } + if (iterations > INT_MAX / 240) { + av_log(avctx, AV_LOG_ERROR, + "Too large input buffer (%d bytes); per-block sample count overflows\n", buf_size); + return AVERROR_INVALIDDATA; + } /* get output buffer */ frame->nb_samples = iterations * 240;