This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/5.1 in repository ffmpeg.
commit 5c67a2e38ee05aa6914c66c20493dc69f40dcbdc Author: Kacper Michajłow <[email protected]> AuthorDate: Sun Mar 22 21:24:25 2026 +0100 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue May 5 15:21:18 2026 +0200 avformat/concat: guard total_size overflow Fixes: 466797413/clusterfuzz-testcase-minimized-fuzzer_options_parser-6015183727427584 Signed-off-by: Kacper Michajłow <[email protected]> (cherry picked from commit 702b0784b73d22da4004757a1f4f3b4cbae5f969) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/concat.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/libavformat/concat.c b/libavformat/concat.c index 825e43a7fa..82e8aee6de 100644 --- a/libavformat/concat.c +++ b/libavformat/concat.c @@ -111,6 +111,12 @@ static av_cold int concat_open(URLContext *h, const char *uri, int flags) break; } + if (total_size > INT64_MAX - size) { + ffurl_close(uc); + err = AVERROR_INVALIDDATA; + break; + } + /* assembling */ nodes[i].uc = uc; nodes[i].size = size; @@ -280,6 +286,12 @@ static av_cold int concatf_open(URLContext *h, const char *uri, int flags) break; } + if (total_size > INT64_MAX - size) { + ffurl_close(uc); + err = AVERROR_INVALIDDATA; + break; + } + nodes = av_fast_realloc(data->nodes, &nodes_size, sizeof(*nodes) * len); if (!nodes) { ffurl_close(uc); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
