ffmpeg-6
Chainguard
Status
Justification
Impact
The jpegxl_parser integer overflow vulnerability has been fixed in FFmpeg 6.1.2. The fix (commit ca09d8a0dc) added overflow protection at libavcodec/jpegxl_parser.c:1383. The check 'size > INT_MAX - ctx->skip' prevents integer overflow in 'ctx->skip += size'. If the addition would exceed INT_MAX, the function returns AVERROR_INVALIDDATA before the overflow can occur. This comprehensive bounds check ensures safe arithmetic operations.
Status