This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.1 in repository ffmpeg.
commit 86dd0a3adfe0ab45f301a8f26e5102015a0525c2 Author: Omkhar Arasaratnam <[email protected]> AuthorDate: Mon May 25 04:47:27 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 14 04:40:54 2026 +0200 avformat/mov: validate APV access unit length before passing to decoder libavformat/mov.c read the APV AU length field directly from the sample without sanity-checking against the remaining sample size or a documented maximum. The patch validates that au_size is bounded by the remaining sample bytes and that the AU envelope (4 bytes plus au_size) fits inside the declared sample size. Validate the access unit length at the demuxer boundary so that the decoder is not handed an attacker-controllable buffer size. Returns AVERROR_INVALIDDATA on the bound failure with an explicit log line. Found-by: Claude (Anthropic). Human-verified and reported by Omkhar Arasaratnam <[email protected]>. Signed-off-by: Omkhar Arasaratnam <[email protected]> (cherry picked from commit 387ad6d1029c6c75a62cf3ed2d2526f8d8329354) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 468715719f..66318cf7fe 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -11481,6 +11481,12 @@ static int mov_read_packet(AVFormatContext *s, AVPacket *pkt) #endif else if (st->codecpar->codec_id == AV_CODEC_ID_APV && sample->size > 4) { const uint32_t au_size = avio_rb32(sc->pb); + if (au_size > sample->size - 4) { + av_log(s, AV_LOG_ERROR, + "APV au_size %u exceeds sample body %d\n", + au_size, sample->size - 4); + return AVERROR_INVALIDDATA; + } ret = av_get_packet(sc->pb, pkt, au_size); } else ret = av_get_packet(sc->pb, pkt, sample->size); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
