This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 332df18e67 avformat/mov: reject tfra boxes smaller than their header
332df18e67 is described below
commit 332df18e67c0f689d4dd5d0b2154e612cd871b3e
Author: Martin Mirchev <[email protected]>
AuthorDate: Tue Oct 27 10:45:34 2026 +0800
Commit: James Almer <[email protected]>
CommitDate: Fri Oct 30 17:20:33 2026 +0000
avformat/mov: reject tfra boxes smaller than their header
mov_read_mfra() calls read_tfra() until it returns non-zero, and
read_tfra() ends by seeking to the box start plus its declared size.
A tfra box with size 0 therefore seeks back onto itself and is parsed
again forever. Since the whole box stays in the AVIOContext buffer, no
read reaches the protocol layer and the interrupt callback is never
checked, so the demuxer cannot be interrupted either.
The mfra is read on the first moof when use_mfra_for is enabled, which
an "Anevia" free box does by default, so a 76-byte file can make
avformat_open_input() spin indefinitely.
Signed-off-by: Martin Mirchev <[email protected]>
---
libavformat/mov.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index e2f33643f7..83bf9fa8d4 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -11013,6 +11013,12 @@ static int read_tfra(MOVContext *mov, AVIOContext *f)
if (avio_rb32(f) != MKBETAG('t', 'f', 'r', 'a')) {
return 1;
}
+ /* A tfra box can not be smaller than its 24-byte header. A size of 0
+ * would make mov_read_mfra() re-read the same box forever. */
+ if (size < 24) {
+ av_log(mov->fc, AV_LOG_ERROR, "Invalid tfra size %"PRIu32"\n", size);
+ return AVERROR_INVALIDDATA;
+ }
av_log(mov->fc, AV_LOG_VERBOSE, "found tfra\n");
version = avio_r8(f);
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
