This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/6.1 in repository ffmpeg.
commit 1b54363cc57a488a9d8d241aa66f969405a0541a Author: Michael Niedermayer <[email protected]> AuthorDate: Thu Feb 12 23:10:32 2026 +0100 Commit: Michael Niedermayer <[email protected]> CommitDate: Mon May 4 17:13:18 2026 +0200 avformat/flvdec: Check *size in cts parsing Fixes: Assertion buf_size >= 0 failed Fixes: 471553942/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5982849812725760 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 6ee3e59ce29c6142722930923f8d3d1b746657f8) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/flvdec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index e25b5bd163..9ea9e16e31 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -1289,6 +1289,10 @@ retry_duration: if (st->codecpar->codec_id == AV_CODEC_ID_H264 || st->codecpar->codec_id == AV_CODEC_ID_MPEG4 || (st->codecpar->codec_id == AV_CODEC_ID_HEVC && type == PacketTypeCodedFrames)) { + if (size < 3) { + ret = AVERROR_INVALIDDATA; + goto leave; + } // sign extension int32_t cts = (avio_rb24(s->pb) + 0xff800000) ^ 0xff800000; pts = av_sat_add64(dts, cts); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
