PR #25273 opened by ffmpeg-devel URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25273 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25273.patch
**Backport:** https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25049 Ensure that adding `priming` and `caf->remainder` will not overflow `st->nb_frames`. >From 6fd236973847e88fd416ca92b0b5ad52de23aa14 Mon Sep 17 00:00:00 2001 From: Marvin Scholz <[email protected]> Date: Tue, 29 Sep 2026 00:30:35 +0000 Subject: [PATCH] lavf/cafdec: prevent signed integer overflow Ensure that adding priming and caf->remainder will not overflow st->nb_frames. Signed-off-by: Marvin Scholz <[email protected]> (cherry picked from commit 9a861e9687d30e657d59521817cad18405995983) --- libavformat/cafdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c index 8816e6b6dc3..cb52a041b90 100644 --- a/libavformat/cafdec.c +++ b/libavformat/cafdec.c @@ -276,6 +276,8 @@ static int read_pakt_chunk(AVFormatContext *s, int64_t size) st->nb_frames = avio_rb64(pb); /* valid frames */ priming = avio_rb32(pb); /* priming frames */ caf->remainder = avio_rb32(pb); /* remainder frames */ + if (st->nb_frames < 0 || INT64_MAX - priming - caf->remainder < st->nb_frames) + return AVERROR_INVALIDDATA; caf->frame_cnt = -(int64_t)priming; st->codecpar->initial_padding = priming; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
