PR #24684 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24684 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24684.patch
Fixes: heap-buffer-overflow (write) Fixes: gSJzpqrLJWHW Fixes: ANT-2026-B5JD9MD9-poc17.mp4 Fixes: ANT-2026-B5JD9MD9-poc255.mp4 Found-by: Claude and Ada Logics >From b3060e38506b4332dc852aaa780e859b40388f31 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 24 Sep 2026 21:54:52 +0200 Subject: [PATCH] avformat/mov: validate the per-sample IV size before storing it Fixes: heap-buffer-overflow (write) Fixes: gSJzpqrLJWHW Fixes: ANT-2026-B5JD9MD9-poc17.mp4 Fixes: ANT-2026-B5JD9MD9-poc255.mp4 Found-by: Claude and Ada Logics --- libavformat/mov.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 8ddedf269b..d514292c9c 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8519,12 +8519,12 @@ static int mov_read_tenc(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (!sc->cenc.encryption_index) return AVERROR(ENOMEM); } - sc->cenc.per_sample_iv_size = avio_r8(pb); - if (sc->cenc.per_sample_iv_size != 0 && sc->cenc.per_sample_iv_size != 8 && - sc->cenc.per_sample_iv_size != 16) { + iv_size = avio_r8(pb); + if (iv_size != 0 && iv_size != 8 && iv_size != 16) { av_log(c->fc, AV_LOG_ERROR, "invalid per-sample IV size value\n"); return AVERROR_INVALIDDATA; } + sc->cenc.per_sample_iv_size = iv_size; if (avio_read(pb, sc->cenc.default_encrypted_sample->key_id, 16) != 16) { av_log(c->fc, AV_LOG_ERROR, "failed to read the default key ID\n"); return AVERROR_INVALIDDATA; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
