PR #22976 opened by dalecurtis URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22976 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22976.patch
The potentially negative return value of av_index_search_timestamp() wasn't being handled before passing it to can_seek_to_key_sample(). Found by Wongi Lee (@_qwerty_po) of Theori with Xint Code, Jungwoo Lee (@physicube). Signed-off-by: Dale Curtis <[email protected]> >From b597e46e03b1a56726eaf6e52a36ce7a8117a069 Mon Sep 17 00:00:00 2001 From: Dale Curtis <[email protected]> Date: Thu, 30 Apr 2026 21:01:33 +0000 Subject: [PATCH] [mov] Fix negative index given to can_seek_to_key_sample() The potentially negative return value of av_index_search_timestamp() wasn't being handled before passing it to can_seek_to_key_sample(). Found by Wongi Lee (@_qwerty_po) of Theori with Xint Code, Jungwoo Lee (@physicube). Signed-off-by: Dale Curtis <[email protected]> --- libavformat/mov.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 8859e296d3..eaef3ed574 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -11591,6 +11591,7 @@ static int can_seek_to_key_sample(AVStream *st, int sample, int64_t requested_pt if (sample >= sc->sample_offsets_count) return 1; + av_assert0(sample >= 0); key_sample_dts = sti->index_entries[sample].timestamp; key_sample_pts = key_sample_dts + sc->sample_offsets[sample] + sc->dts_shift; @@ -11634,6 +11635,8 @@ static int mov_seek_stream(AVFormatContext *s, AVStream *st, int64_t timestamp, next_ts = timestamp - FFMAX(sc->min_sample_duration, 1); requested_sample = av_index_search_timestamp(st, next_ts, flags); + if (requested_sample < 0) + return AVERROR_INVALIDDATA; // If we've reached a different sample trying to find a good pts to // seek to, give up searching because we'll end up seeking back to -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
