PR #22894 opened by dalecurtis URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22894 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22894.patch
This prevents issues on 32-bit systems where atom.size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE. Signed-off-by: Dale Curtis <[email protected]> >From f3a305ca607b369afe76e8d40ea5b1728b372c90 Mon Sep 17 00:00:00 2001 From: Dale Curtis <[email protected]> Date: Wed, 22 Apr 2026 20:19:02 +0000 Subject: [PATCH] [mov] Limit maximum box size for mov_read_lhvc() Signed-off-by: Dale Curtis <[email protected]> --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index e2e6b1c5f3..f69d28184f 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8677,7 +8677,7 @@ static int mov_read_lhvc(MOVContext *c, AVIOContext *pb, MOVAtom atom) // TODO: handle lhvC when present before hvcC return 0; - if (atom.size < 6 || st->codecpar->extradata_size < 23) + if (atom.size < 6 || st->codecpar->extradata_size < 23 || (uint64_t)atom.size > (1<<30)) return AVERROR_INVALIDDATA; buf = av_malloc(atom.size + AV_INPUT_BUFFER_PADDING_SIZE); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
