From 922ef1fa41eb614d4ffb87f9660402d156ec3ddf Mon Sep 17 00:00:00 2001
From: Ori Hollander <orih@jfrog.com>
Date: Sat, 9 May 2026 00:00:00 +0000
Subject: [PATCH] avcodec/magicyuv: reject slice_height misaligned with chroma
 vshift

Fixes: poc_magicyuv.avi
Fixes: out of array access

Found-by: Ori Hollander of the JFrog Vulnerability Research team
(cherry picked from commit 374b726ffa878ee1cadb987bd1e1e20cc7ed8845)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/magicyuv.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libavcodec/magicyuv.c b/libavcodec/magicyuv.c
index 3e449200ea..e4baa38c42 100644
--- a/libavcodec/magicyuv.c
+++ b/libavcodec/magicyuv.c
@@ -570,6 +570,13 @@ static int magy_decode_frame(AVCodecContext *avctx, AVFrame *p,
                "invalid slice height: %d\n", s->slice_height);
         return AVERROR_INVALIDDATA;
     }
+    if (s->vshift[1] && (s->slice_height & ((1 << s->vshift[1]) - 1))) {
+        av_log(avctx, AV_LOG_ERROR,
+               "slice_height %d is not aligned to chroma vertical "
+               "subsampling (must be a multiple of %d)\n",
+               s->slice_height, 1 << s->vshift[1]);
+        return AVERROR_INVALIDDATA;
+    }
 
     bytestream2_skipu(&gb, 4);