PR #22409 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22409 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22409.patch
Fixes: infinite loop Fixes: 487632033/clusterfuzz-testcase-minimized-ffmpeg_dem_IMAGE2_fuzzer-4565877872984064 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> >From e7c246d499a7124c08e047823d0d9512c6fa9913 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 5 Mar 2026 16:38:03 +0100 Subject: [PATCH] avformat/hxvs: Do not allow backward steps in hxvs_probe() Fixes: infinite loop Fixes: 487632033/clusterfuzz-testcase-minimized-ffmpeg_dem_IMAGE2_fuzzer-4565877872984064 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/hxvs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/hxvs.c b/libavformat/hxvs.c index ed827c8d97..998faed803 100644 --- a/libavformat/hxvs.c +++ b/libavformat/hxvs.c @@ -118,6 +118,10 @@ static int hxvs_probe(const AVProbeData *p) i += 4; if (tag == HXVF || tag == HXAF) { bytes = AV_RL32(&p->buf[i]); + + if (12 + bytes > INT_MAX - i) + return 0; + i += 12 + bytes; flag |= (tag == HXVF) ? 2 : 4; continue; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
