This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/6.1 in repository ffmpeg.
commit cd400686d3b12837e4baf47353dffc8ed66e893e Author: Michael Niedermayer <[email protected]> AuthorDate: Fri May 29 17:56:22 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 14 20:00:25 2026 +0200 avformat/matroskadec: bound TRACKENTRY parsing by max_streams After the fix the reproducer finishes in 43 ms instead of OOM-ing at the 2 GB limit. Legitimate .mkv/.webm fate samples still parse cleanly. Fixes: 471604245/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6662979358883840 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit c7e0bac050a672a220ed8ee6dbdc25abfb3336a8) Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 20a797c3efeaa4e8b56b69da1f21d26b707a37d7) --- libavformat/matroskadec.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index 2c405ee662..801647144e 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -1329,6 +1329,13 @@ static int ebml_parse(MatroskaDemuxContext *matroska, if ((unsigned)list->nb_elem + 1 >= UINT_MAX / syntax->list_elem_size) return AVERROR(ENOMEM); + if (syntax->id == MATROSKA_ID_TRACKENTRY && + list->nb_elem >= matroska->ctx->max_streams) { + av_log(matroska->ctx, AV_LOG_ERROR, + "Number of tracks exceeds max_streams (%d)\n", + matroska->ctx->max_streams); + return AVERROR(EINVAL); + } newelem = av_fast_realloc(list->elem, &list->alloc_elem_size, (list->nb_elem + 1) * syntax->list_elem_size); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
