This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.1 in repository ffmpeg.
commit 76fd415fce9e7f9c3cb7a38a834fc8b3d5a5af81 Author: Dale Curtis <[email protected]> AuthorDate: Wed Apr 22 20:19:02 2026 +0000 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun May 3 19:24:53 2026 +0200 avformat/mov: Limit maximum box size for mov_read_lhvc() Signed-off-by: Dale Curtis <[email protected]> (cherry picked from commit a7d42bfba8bbdfd028f930ca24fc7afc8150bef4) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 86b67d1d60..e013e1cba5 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8677,8 +8677,10 @@ static int mov_read_lhvc(MOVContext *c, AVIOContext *pb, MOVAtom atom) // TODO: handle lhvC when present before hvcC return 0; - if (atom.size < 6 || st->codecpar->extradata_size < 23) + if (atom.size < 6 || st->codecpar->extradata_size < 23 || + atom.size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) { return AVERROR_INVALIDDATA; + } buf = av_malloc(atom.size + AV_INPUT_BUFFER_PADDING_SIZE); if (!buf) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
