This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch release/9.0
in repository ffmpeg.

commit 999f8ba75ce0bf1167677de7e11a5af678fdb866
Author:     Joshua Rogers <[email protected]>
AuthorDate: Tue Aug 4 12:11:55 2026 +0000
Commit:     Michael Niedermayer <[email protected]>
CommitDate: Wed Aug 12 04:51:59 2026 +0200

    avformat/dashdec: reject a negative fragment index
    
    A live manifest whose startNumber decreases across a refresh drives
    cur_seq_no negative in move_segments(); get_current_fragment() only checked
    the upper bound before indexing fragments[]. Add a lower-bound check and
    clamp the negative delta at its source.
    
    Fixes: out of array read
    (cherry picked from commit 65b0dab903e5975e036b30ecc58f5935d4f151e0)
    Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavformat/dashdec.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index 3dad770d54..3d5519b706 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -1537,8 +1537,11 @@ static void move_segments(struct representation 
*rep_src, struct representation
         free_fragment_list(rep_dest);
         if (rep_src->start_number > (rep_dest->start_number + 
rep_dest->n_fragments))
             rep_dest->cur_seq_no = 0;
-        else
+        else {
             rep_dest->cur_seq_no += rep_src->start_number - 
rep_dest->start_number;
+            if (rep_dest->cur_seq_no < 0)
+                rep_dest->cur_seq_no = 0;
+        }
         rep_dest->fragments    = rep_src->fragments;
         rep_dest->n_fragments  = rep_src->n_fragments;
         rep_dest->parent  = rep_src->parent;
@@ -1658,7 +1661,7 @@ static struct fragment *get_current_fragment(struct 
representation *pls)
     int reload_count = 0;
 
     while (( !ff_check_interrupt(c->interrupt_callback)&& pls->n_fragments > 
0)) {
-        if (pls->cur_seq_no < pls->n_fragments) {
+        if (pls->cur_seq_no >= 0 && pls->cur_seq_no < pls->n_fragments) {
             seg_ptr = pls->fragments[pls->cur_seq_no];
             seg = av_mallocz(sizeof(struct fragment));
             if (!seg) {

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to