This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit c3aa28f23d5098b6ec2e8d537d4b9163c483a3ec Author: James Almer <[email protected]> AuthorDate: Sun Feb 22 11:12:23 2026 -0300 Commit: James Almer <[email protected]> CommitDate: Mon Feb 23 00:43:50 2026 +0000 avformat/mov: check for EOF in more loops Signed-off-by: James Almer <[email protected]> --- libavformat/mov.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 1ae6c262c2..2b2a2da9f2 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -9149,8 +9149,13 @@ static int mov_read_iref_dimg(MOVContext *c, AVIOContext *pb, int version) if (!grid->tile_id_list || !grid->tile_item_list || !grid->tile_idx_list) return AVERROR(ENOMEM); /* 'to' item ids */ - for (i = 0; i < entries; i++) + for (i = 0; i < entries; i++) { grid->tile_id_list[i] = version ? avio_rb32(pb) : avio_rb16(pb); + + if (avio_feof(pb)) + return AVERROR_INVALIDDATA; + } + grid->nb_tiles = entries; grid->item = item; @@ -9177,6 +9182,10 @@ static int mov_read_iref_cdsc(MOVContext *c, AVIOContext *pb, uint32_t type, int /* 'to' item ids */ for (int i = 0; i < entries; i++) { HEIFItem *item = get_heif_item(c, version ? avio_rb32(pb) : avio_rb16(pb)); + + if (avio_feof(pb)) + return AVERROR_INVALIDDATA; + if (!item) { av_log(c->fc, AV_LOG_WARNING, "Missing stream referenced by %s item\n", av_fourcc2str(type)); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
