This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 6d300b4732 avformat/mov: avoid overflow/negative discard sample
duration
6d300b4732 is described below
commit 6d300b473266cda5926d86fe5a9d126c9c10b3c6
Author: Michael Niedermayer <[email protected]>
AuthorDate: Fri Jul 3 04:47:40 2026 +0200
Commit: Michael Niedermayer <[email protected]>
CommitDate: Sun Jul 19 02:48:42 2026 +0200
avformat/mov: avoid overflow/negative discard sample duration
This also fixes a corner case with st->duration = INT64_MAX
This assumes pkt->duration >= 0
Fixes:
525566001/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5952332261818368
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/mov.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 2c95434b27..dc425e4e9f 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -11777,8 +11777,11 @@ static int mov_finalize_packet(AVFormatContext *s,
AVStream *st, AVIndexEntry *s
int64_t total = av_rescale_q(st->duration, st->time_base,
(AVRational){ 1, st->codecpar->sample_rate });
int64_t duration = pkt->duration;
- if (av_sat_add64(pkt->pts, pkt->duration) > st->duration)
- duration = st->duration - pkt->pts;
+ if (st->duration < pkt->pts) {
+ duration = 0;
+ } else
+ duration = FFMIN(duration, (uint64_t)st->duration - pkt->pts);
+
duration = av_rescale_q(duration, st->time_base, (AVRational){ 1,
st->codecpar->sample_rate });
if (!ffstream(st)->first_discard_sample)
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
