This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.0 in repository ffmpeg.
commit bf3bbf184a0b0f64433bbc1f02c37461dac39918 Author: Kacper Michajłow <[email protected]> AuthorDate: Sun Mar 22 21:24:25 2026 +0100 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun May 3 19:57:02 2026 +0200 avformat/concat: guard total_size overflow Fixes: 466797413/clusterfuzz-testcase-minimized-fuzzer_options_parser-6015183727427584 Signed-off-by: Kacper Michajłow <[email protected]> (cherry picked from commit 702b0784b73d22da4004757a1f4f3b4cbae5f969) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/concat.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/libavformat/concat.c b/libavformat/concat.c index e1d57de557..31aa1741d5 100644 --- a/libavformat/concat.c +++ b/libavformat/concat.c @@ -113,6 +113,12 @@ static av_cold int concat_open(URLContext *h, const char *uri, int flags) break; } + if (total_size > INT64_MAX - size) { + ffurl_close(uc); + err = AVERROR_INVALIDDATA; + break; + } + /* assembling */ nodes[i].uc = uc; nodes[i].size = size; @@ -282,6 +288,12 @@ static av_cold int concatf_open(URLContext *h, const char *uri, int flags) break; } + if (total_size > INT64_MAX - size) { + ffurl_close(uc); + err = AVERROR_INVALIDDATA; + break; + } + nodes = av_fast_realloc(data->nodes, &nodes_size, sizeof(*nodes) * len); if (!nodes) { ffurl_close(uc); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
