This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 86708357d1 avformat/iamf_parse: check count_label against the
available bytes
86708357d1 is described below
commit 86708357d126af84c16f80d9c57335d1e8c845c5
Author: Michael Niedermayer <[email protected]>
AuthorDate: Sun Jun 28 22:05:28 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Sun Jun 28 23:57:40 2026 +0000
avformat/iamf_parse: check count_label against the available bytes
Fixes: unbounded allocation / denial of service
Fixes: tP59h4cpaFyg
Fixes: 4ee05182b7 (avformat: Immersive Audio Model and Formats demuxer)
Found-by: Adrian Junge (vurlo)
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/iamf_parse.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index d74a8677d6..4c2df2c9e6 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -1009,6 +1009,11 @@ static int mix_presentation_obu(void *s, IAMFContext *c,
AVIOContext *pb, int le
mix_presentation->cmix = mix;
mix_presentation->count_label = ffio_read_leb(pbc);
+ if (mix_presentation->count_label > len - avio_tell(pbc)) {
+ mix_presentation->count_label = 0;
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
+ }
mix_presentation->language_label = av_calloc(mix_presentation->count_label,
sizeof(*mix_presentation->language_label));
if (!mix_presentation->language_label) {
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
