This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 702b0784b73d22da4004757a1f4f3b4cbae5f969 Author: Kacper Michajłow <[email protected]> AuthorDate: Sun Mar 22 21:24:25 2026 +0100 Commit: Kacper Michajłow <[email protected]> CommitDate: Sun May 3 07:30:46 2026 +0000 avformat/concat: guard total_size overflow Fixes: 466797413/clusterfuzz-testcase-minimized-fuzzer_options_parser-6015183727427584 Signed-off-by: Kacper Michajłow <[email protected]> --- libavformat/concat.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/libavformat/concat.c b/libavformat/concat.c index 92efc61185..f15cee2ff4 100644 --- a/libavformat/concat.c +++ b/libavformat/concat.c @@ -114,6 +114,12 @@ static av_cold int concat_open(URLContext *h, const char *uri, int flags) break; } + if (total_size > INT64_MAX - size) { + ffurl_close(uc); + err = AVERROR_INVALIDDATA; + break; + } + /* assembling */ nodes[i].uc = uc; nodes[i].size = size; @@ -284,6 +290,12 @@ static av_cold int concatf_open(URLContext *h, const char *uri, int flags) break; } + if (total_size > INT64_MAX - size) { + ffurl_close(uc); + err = AVERROR_INVALIDDATA; + break; + } + nodes = av_fast_realloc(data->nodes, &nodes_size, sizeof(*nodes) * len); if (!nodes) { ffurl_close(uc); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
