This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new d8990137ee libavformat/flacdec: error on overflow in metadata
d8990137ee is described below
commit d8990137eec96e8ead292f5de2fc2c6de450e676
Author: Ted Meyer <[email protected]>
AuthorDate: Wed Oct 15 14:00:18 2025 -0700
Commit: Lynne <[email protected]>
CommitDate: Sat Oct 24 02:31:48 2026 +0000
libavformat/flacdec: error on overflow in metadata
if accumulating metadata_head_size would lead to an integer overflow,
return an error instead
---
libavformat/flacdec.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/libavformat/flacdec.c b/libavformat/flacdec.c
index 12d4b7305f..1f5cfeed71 100644
--- a/libavformat/flacdec.c
+++ b/libavformat/flacdec.c
@@ -42,12 +42,16 @@ typedef struct FLACDecContext {
AVCodecContext *parser_dec;
} FLACDecContext;
-static void reset_index_position(int64_t metadata_head_size, AVStream *st)
+static int reset_index_position(int64_t metadata_head_size, AVStream *st)
{
FFStream *const sti = ffstream(st);
/* the real seek index offset should be the size of metadata blocks with
the offset in the frame blocks */
- for (int i = 0; i < sti->nb_index_entries; i++)
+ for (int i = 0; i < sti->nb_index_entries; i++) {
+ if (0x7FFFFFFFFFFFFFFF - metadata_head_size <
sti->index_entries[i].pos)
+ return AVERROR_INVALIDDATA;
sti->index_entries[i].pos += metadata_head_size;
+ }
+ return 0;
}
static const uint16_t sr_table[16] = {
@@ -225,7 +229,8 @@ static int flac_read_header(AVFormatContext *s)
if (ret < 0)
return ret;
- reset_index_position(avio_tell(s->pb), st);
+ if (ret = reset_index_position(avio_tell(s->pb), st))
+ return ret;
return 0;
fail:
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
