PR #22898 opened by Ted Meyer (usepgp) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22898 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22898.patch
In the TRUN box parser, there is a reallocation of the `sti->index_entries` field with an increased size. The loop that reads new data has some early returns which leaves `sti->index_entries` with uninitialized memory within the range of `sti->nb_index_entries`. If a client of ffmpeg (such as chromium) interprets AVERROR_INVALIDDATA as a non-fatal error signal and re-enters the demuxer via `ff_index_search_timestamp`, there might be reads from the uninitialized memory. This fix just sets all the size counters that were incremented to actually hold the count of properly initialized `sti->index_entries`, including `sti->index_entries`, `sc->tts_count`, `sc->stts_count`, and sometimes `sc->ctts_count`. >From beda185f785736040d7a4a33d451460c3556aa67 Mon Sep 17 00:00:00 2001 From: Ted Meyer <[email protected]> Date: Wed, 22 Apr 2026 15:25:54 -0700 Subject: [PATCH] avformat/mov: Fix entries count on early return In the TRUN box parser, there is a reallocation of the `sti->index_entries` field with an increased size. The loop that reads new data has some early returns which leaves `sti->index_entries` with uninitialized memory within the range of `sti->nb_index_entries`. If a client of ffmpeg (such as chromium) interprets AVERROR_INVALIDDATA as a non-fatal error signal and re-enters the demuxer via `ff_index_search_timestamp`, there might be reads from the uninitialized memory. This fix just sets all the size counters that were incremented to actually hold the count of properly initialized `sti->index_entries`, including `sti->index_entries`, `sc->tts_count`, `sc->stts_count`, and sometimes `sc->ctts_count`. --- libavformat/mov.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index dc9233b8a8..602a775bc1 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -6042,10 +6042,11 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom) "size %u, distance %d, keyframe %d\n", st->index, index_entry_pos, offset, dts, sample_size, distance, keyframe); distance++; - if (av_sat_add64(dts, sample_duration) != dts + (uint64_t)sample_duration) - return AVERROR_INVALIDDATA; - if (!sample_size) + if (!sample_size || av_sat_add64(dts, sample_duration) != dts + (uint64_t)sample_duration) { + sti->nb_index_entries = sc->tts_count = sc->stts_count = index_entry_pos; + if (flags & MOV_TRUN_SAMPLE_CTS) sc->ctts_count = index_entry_pos; return AVERROR_INVALIDDATA; + } dts += sample_duration; offset += sample_size; sc->data_size += sample_size; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
