This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 1b8b99dd459361fed8a4b99b02b74b33fee18a14 Author: Michael Niedermayer <[email protected]> AuthorDate: Fri Jul 3 04:47:40 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue Jul 21 23:00:00 2026 +0200 avformat/mov: avoid overflow/negative discard sample duration This also fixes a corner case with st->duration = INT64_MAX This assumes pkt->duration >= 0 Fixes: 525566001/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5952332261818368 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 6d300b473266cda5926d86fe5a9d126c9c10b3c6) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 4154038d9e..98e5e4de9a 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -11666,8 +11666,11 @@ static int mov_finalize_packet(AVFormatContext *s, AVStream *st, AVIndexEntry *s int64_t total = av_rescale_q(st->duration, st->time_base, (AVRational){ 1, st->codecpar->sample_rate }); int64_t duration = pkt->duration; - if (av_sat_add64(pkt->pts, pkt->duration) > st->duration) - duration = st->duration - pkt->pts; + if (st->duration < pkt->pts) { + duration = 0; + } else + duration = FFMIN(duration, (uint64_t)st->duration - pkt->pts); + duration = av_rescale_q(duration, st->time_base, (AVRational){ 1, st->codecpar->sample_rate }); if (!ffstream(st)->first_discard_sample) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
