This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/7.1 in repository ffmpeg.
commit 6ab9059bab60cc806e4b70bc1cc3369d1393874e Author: Dale Curtis <[email protected]> AuthorDate: Wed Apr 22 20:19:02 2026 +0000 Commit: Michael Niedermayer <[email protected]> CommitDate: Mon May 4 15:57:26 2026 +0200 avformat/mov: Limit maximum box size for mov_read_lhvc() Signed-off-by: Dale Curtis <[email protected]> (cherry picked from commit a7d42bfba8bbdfd028f930ca24fc7afc8150bef4) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 921ea8db3a..4321252c98 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8364,8 +8364,10 @@ static int mov_read_lhvc(MOVContext *c, AVIOContext *pb, MOVAtom atom) // TODO: handle lhvC when present before hvcC return 0; - if (atom.size < 6 || st->codecpar->extradata_size < 23) + if (atom.size < 6 || st->codecpar->extradata_size < 23 || + atom.size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) { return AVERROR_INVALIDDATA; + } buf = av_malloc(atom.size + AV_INPUT_BUFFER_PADDING_SIZE); if (!buf) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
