The branch, master has been updated
via a2cfaf1b916cd4519249031adc37e339baca7a7b (commit)
via a28e01a6c16430da689340d0af6eec094020b719 (commit)
from 7df92712723dee0ace3596684a90282c0e12a8ef (commit)
- Log -----------------------------------------------------------------
commit a2cfaf1b916cd4519249031adc37e339baca7a7b
Author: James Almer <[email protected]>
AuthorDate: Sat Aug 16 21:38:32 2025 -0300
Commit: James Almer <[email protected]>
CommitDate: Sat Aug 16 21:59:18 2025 -0300
avformat/mov: pass stream index to sanity_checks on HEIF images
Instead of item_id. Same behavior as with standard video tracks.
Signed-off-by: James Almer <[email protected]>
diff --git a/libavformat/mov.c b/libavformat/mov.c
index b29c41a6b6..e9a582e5aa 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -10470,7 +10470,7 @@ static int mov_parse_heif_items(AVFormatContext *s)
sc->sample_size = sc->stsz_sample_size = item->extent_length;
sc->sample_count = 1;
- err = sanity_checks(s, sc, item->item_id);
+ err = sanity_checks(s, sc, st->index);
if (err)
return AVERROR_INVALIDDATA;
commit a28e01a6c16430da689340d0af6eec094020b719
Author: James Almer <[email protected]>
AuthorDate: Sat Aug 16 14:16:38 2025 -0300
Commit: James Almer <[email protected]>
CommitDate: Sat Aug 16 21:59:18 2025 -0300
avformat/mov: don't use an allocated array for sample_size with HEIF images
The array is only ever needed for streams where each sample entry may have a
different value. Given that for non animated HEIF there's a single value
that
applies to the image, use the field defined for that.
Fixes: NULL pointer dereference
Fixes:
437528618/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6537287645331456
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <[email protected]>
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 86037c6712..b29c41a6b6 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5456,10 +5456,6 @@ static int heif_add_stream(MOVContext *c, HEIFItem *item)
if (!sc->chunk_offsets)
goto fail;
sc->chunk_count = 1;
- sc->sample_sizes = av_malloc_array(1, sizeof(*sc->sample_sizes));
- if (!sc->sample_sizes)
- goto fail;
- sc->sample_count = 1;
sc->stts_data = av_malloc_array(1, sizeof(*sc->stts_data));
if (!sc->stts_data)
goto fail;
@@ -10471,11 +10467,13 @@ static int mov_parse_heif_items(AVFormatContext *s)
st->codecpar->width = item->width;
st->codecpar->height = item->height;
+ sc->sample_size = sc->stsz_sample_size = item->extent_length;
+ sc->sample_count = 1;
+
err = sanity_checks(s, sc, item->item_id);
- if (err || !sc->sample_count)
+ if (err)
return AVERROR_INVALIDDATA;
- sc->sample_sizes[0] = item->extent_length;
sc->chunk_offsets[0] = item->extent_offset + offset;
if (item->item_id == mov->primary_item_id)
-----------------------------------------------------------------------
Summary of changes:
libavformat/mov.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
hooks/post-receive
--
_______________________________________________
ffmpeg-cvslog mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".
