PR #22581 opened by Kacper Michajłow (kasper93) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22581 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22581.patch
While at it change total_size to match type in concat_data struct. Fixes: 466797413/clusterfuzz-testcase-minimized-fuzzer_options_parser-6015183727427584 From 1354eb145286c482eb31399625bb1f8af0e2c51c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <[email protected]> Date: Sun, 22 Mar 2026 21:24:25 +0100 Subject: [PATCH] avformat/concat: guard total_size overflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit While at it change total_size to match type in concat_data struct. Fixes: 466797413/clusterfuzz-testcase-minimized-fuzzer_options_parser-6015183727427584 Signed-off-by: Kacper Michajłow <[email protected]> --- libavformat/concat.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/libavformat/concat.c b/libavformat/concat.c index e1d57de557..93abd436ed 100644 --- a/libavformat/concat.c +++ b/libavformat/concat.c @@ -67,7 +67,8 @@ static av_cold int concat_open(URLContext *h, const char *uri, int flags) { char *node_uri = NULL; int err = 0; - int64_t size, total_size = 0; + int64_t size; + uint64_t total_size = 0; size_t len, i; URLContext *uc; struct concat_data *data = h->priv_data; @@ -113,6 +114,12 @@ static av_cold int concat_open(URLContext *h, const char *uri, int flags) break; } + if (total_size > UINT64_MAX - size) { + ffurl_close(uc); + err = AVERROR(EOVERFLOW); + break; + } + /* assembling */ nodes[i].uc = uc; nodes[i].size = size; @@ -215,7 +222,7 @@ static av_cold int concatf_open(URLContext *h, const char *uri, int flags) struct concat_data *data = h->priv_data; AVIOContext *in = NULL; const char *cursor; - int64_t total_size = 0; + uint64_t total_size = 0; unsigned int nodes_size = 0; size_t i = 0; int err; @@ -282,6 +289,12 @@ static av_cold int concatf_open(URLContext *h, const char *uri, int flags) break; } + if (total_size > UINT64_MAX - size) { + ffurl_close(uc); + err = AVERROR(EOVERFLOW); + break; + } + nodes = av_fast_realloc(data->nodes, &nodes_size, sizeof(*nodes) * len); if (!nodes) { ffurl_close(uc); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
