PR #25274 opened by ffmpeg-devel URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25274 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25274.patch
**Backport:** https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25049 Ensure that adding `priming` and `caf->remainder` will not overflow `st->nb_frames`. >From e37b671570c50f4a2457986343d5f09ed8678c52 Mon Sep 17 00:00:00 2001 From: Marvin Scholz <[email protected]> Date: Tue, 29 Sep 2026 00:30:35 +0000 Subject: [PATCH] lavf/cafdec: prevent signed integer overflow Ensure that adding priming and caf->remainder will not overflow st->nb_frames. Signed-off-by: Marvin Scholz <[email protected]> (cherry picked from commit 9a861e9687d30e657d59521817cad18405995983) --- libavformat/cafdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c index 41ae1bc1211..fae4d7db5ec 100644 --- a/libavformat/cafdec.c +++ b/libavformat/cafdec.c @@ -277,6 +277,8 @@ static int read_pakt_chunk(AVFormatContext *s, int64_t size) st->nb_frames = avio_rb64(pb); /* valid frames */ priming = avio_rb32(pb); /* priming frames */ caf->remainder = avio_rb32(pb); /* remainder frames */ + if (st->nb_frames < 0 || INT64_MAX - priming - caf->remainder < st->nb_frames) + return AVERROR_INVALIDDATA; caf->frame_cnt = -(int64_t)priming; st->codecpar->initial_padding = priming; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
