This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch release/9.0
in repository ffmpeg.
The following commit(s) were added to refs/heads/release/9.0 by this push:
new 6882969ce9 lavf/cafdec: prevent signed integer overflow
6882969ce9 is described below
commit 6882969ce9fd2aa6aa1d0008b2bfe1c838aac11d
Author: Marvin Scholz <[email protected]>
AuthorDate: Tue Sep 29 00:30:35 2026 +0000
Commit: Marvin Scholz <[email protected]>
CommitDate: Sun Oct 25 02:02:10 2026 +0000
lavf/cafdec: prevent signed integer overflow
Ensure that adding priming and caf->remainder will not overflow
st->nb_frames.
Signed-off-by: Marvin Scholz <[email protected]>
(cherry picked from commit 9a861e9687d30e657d59521817cad18405995983)
---
libavformat/cafdec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c
index 41ae1bc121..fae4d7db5e 100644
--- a/libavformat/cafdec.c
+++ b/libavformat/cafdec.c
@@ -277,6 +277,8 @@ static int read_pakt_chunk(AVFormatContext *s, int64_t size)
st->nb_frames = avio_rb64(pb); /* valid frames */
priming = avio_rb32(pb); /* priming frames */
caf->remainder = avio_rb32(pb); /* remainder frames */
+ if (st->nb_frames < 0 || INT64_MAX - priming - caf->remainder <
st->nb_frames)
+ return AVERROR_INVALIDDATA;
caf->frame_cnt = -(int64_t)priming;
st->codecpar->initial_padding = priming;
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
