This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.0 in repository ffmpeg.
commit 2d0bdf26af9d6699befb9d320d3fa7d8d1c24f2d Author: Omkhar Arasaratnam <[email protected]> AuthorDate: Mon May 25 04:47:27 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 14 04:59:02 2026 +0200 avformat/mov: validate APV access unit length before passing to decoder libavformat/mov.c read the APV AU length field directly from the sample without sanity-checking against the remaining sample size or a documented maximum. The patch validates that au_size is bounded by the remaining sample bytes and that the AU envelope (4 bytes plus au_size) fits inside the declared sample size. Validate the access unit length at the demuxer boundary so that the decoder is not handed an attacker-controllable buffer size. Returns AVERROR_INVALIDDATA on the bound failure with an explicit log line. Found-by: Claude (Anthropic). Human-verified and reported by Omkhar Arasaratnam <[email protected]>. Signed-off-by: Omkhar Arasaratnam <[email protected]> (cherry picked from commit 387ad6d1029c6c75a62cf3ed2d2526f8d8329354) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 6ec4f28cdc..00766a5a09 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -11272,6 +11272,12 @@ static int mov_read_packet(AVFormatContext *s, AVPacket *pkt) #endif else if (st->codecpar->codec_id == AV_CODEC_ID_APV && sample->size > 4) { const uint32_t au_size = avio_rb32(sc->pb); + if (au_size > sample->size - 4) { + av_log(s, AV_LOG_ERROR, + "APV au_size %u exceeds sample body %d\n", + au_size, sample->size - 4); + return AVERROR_INVALIDDATA; + } ret = av_get_packet(sc->pb, pkt, au_size); } else ret = av_get_packet(sc->pb, pkt, sample->size); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
