This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new a100d346da avformat/mov: bound sgpd sync entry_count by the atom size
a100d346da is described below
commit a100d346dafd012bfc0c20098a764c6d01a05714
Author: Michael Niedermayer <[email protected]>
AuthorDate: Wed Jul 22 06:17:01 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Thu Jul 30 00:13:05 2026 +0000
avformat/mov: bound sgpd sync entry_count by the atom size
Fixes: unbounded allocation
Fixes: ffmpeg-sgpd-sync-entry-count-alloc.mp4
Fixes: 4f7OaHqbUKh2
Found-by: Brian Lee, Youngjoon Kim (Georgia Tech SSLab)
---
libavformat/mov.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 46a947e26a..6a43082cb3 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4084,6 +4084,9 @@ static int mov_read_sgpd(MOVContext *c, AVIOContext *pb,
MOVAtom atom)
default_group_description_index = version >= 2 ? avio_rb32(pb) : 0;
entry_count = avio_rb32(pb);
+ if (entry_count > atom.size)
+ return AVERROR_INVALIDDATA;
+
av_freep(&sc->sgpd_sync);
sc->sgpd_sync_count = entry_count;
sc->sgpd_sync = av_calloc(entry_count, sizeof(*sc->sgpd_sync));
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
