PR #22979 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22979
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22979.patch
av_index_search_timestamp() returns a negative value when a seek target
cannot be resolved from the stream index. Bail out before using that
result as an index into sti->index_entries to avoid out-of-bounds reads.
>From cf3a34bc45fcc269c21e8f8fc8751490c3743f82 Mon Sep 17 00:00:00 2001
From: "depthfirst-dev[bot]"
<1012587+depthfirst-dev[bot]@users.noreply.github.com>
Date: Thu, 23 Apr 2026 02:47:11 +0000
Subject: [PATCH] avformat/cafdec: fix negative index use in read_seek
av_index_search_timestamp() returns a negative value when a seek target
cannot be resolved from the stream index. Bail out before using that
result as an index into sti->index_entries to avoid out-of-bounds reads.
---
libavformat/cafdec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c
index a7789aee59..41ae1bc121 100644
--- a/libavformat/cafdec.c
+++ b/libavformat/cafdec.c
@@ -568,6 +568,8 @@ static int read_seek(AVFormatContext *s, int stream_index,
frame_cnt = caf->frames_per_packet * packet_cnt -
st->codecpar->initial_padding;
} else if (sti->nb_index_entries) {
packet_cnt = av_index_search_timestamp(st, timestamp, flags);
+ if (packet_cnt < 0)
+ return -1;
frame_cnt = sti->index_entries[packet_cnt].timestamp;
pos = sti->index_entries[packet_cnt].pos;
} else {
--
2.52.0
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
