This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 9a861e9687 lavf/cafdec: prevent signed integer overflow
9a861e9687 is described below
commit 9a861e9687d30e657d59521817cad18405995983
Author: Marvin Scholz <[email protected]>
AuthorDate: Tue Sep 29 00:30:35 2026 +0000
Commit: Marvin Scholz <[email protected]>
CommitDate: Tue Oct 20 23:43:01 2026 +0000
lavf/cafdec: prevent signed integer overflow
Ensure that adding priming and caf->remainder will not overflow
st->nb_frames.
Signed-off-by: Marvin Scholz <[email protected]>
---
libavformat/cafdec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c
index 41ae1bc121..fae4d7db5e 100644
--- a/libavformat/cafdec.c
+++ b/libavformat/cafdec.c
@@ -277,6 +277,8 @@ static int read_pakt_chunk(AVFormatContext *s, int64_t size)
st->nb_frames = avio_rb64(pb); /* valid frames */
priming = avio_rb32(pb); /* priming frames */
caf->remainder = avio_rb32(pb); /* remainder frames */
+ if (st->nb_frames < 0 || INT64_MAX - priming - caf->remainder <
st->nb_frames)
+ return AVERROR_INVALIDDATA;
caf->frame_cnt = -(int64_t)priming;
st->codecpar->initial_padding = priming;
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
