This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new c705686a33 avformat/mov: prevent float-cast-overflow in mov_read_clap
c705686a33 is described below
commit c705686a33f0f195f1190392a68b3342f847944a
Author: Marvin Scholz <[email protected]>
AuthorDate: Thu Oct 1 16:34:37 2026 +0000
Commit: Marvin Scholz <[email protected]>
CommitDate: Wed Oct 14 02:17:06 2026 +0000
avformat/mov: prevent float-cast-overflow in mov_read_clap
horiz_off.num and vert_off.num are signed integers and may be
negative, which can make the calculated top, bottom, left, or right crop
coordinates negative before bounds checking. Casting a negative double
to uint64_t is undefined behavior. Additionally, zero denominators for
the rational values were not rejected.
Use int64_t for top, bottom, left, and right, reject zero denominators,
and check for negative coordinates.
Signed-off-by: Marvin Scholz <[email protected]>
---
libavformat/mov.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 4870070cbf..a89747666b 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1379,7 +1379,7 @@ static int mov_read_clap(MOVContext *c, AVIOContext *pb,
MOVAtom atom)
int width, height, err = 0;
AVRational aperture_width, aperture_height, horiz_off, vert_off;
AVRational pc_x, pc_y;
- uint64_t top, bottom, left, right;
+ int64_t top, bottom, left, right;
item = get_heif_item(c, c->cur_item_id);
st = get_curr_st(c);
@@ -1407,9 +1407,9 @@ static int mov_read_clap(MOVContext *c, AVIOContext *pb,
MOVAtom atom)
vert_off.num = avio_rb32(pb);
vert_off.den = avio_rb32(pb);
- if (aperture_width.num < 0 || aperture_width.den < 0 ||
- aperture_height.num < 0 || aperture_height.den < 0 ||
- horiz_off.den < 0 || vert_off.den < 0) {
+ if (aperture_width.num < 0 || aperture_width.den <= 0 ||
+ aperture_height.num < 0 || aperture_height.den <= 0 ||
+ horiz_off.den <= 0 || vert_off.den <= 0) {
err = AVERROR_INVALIDDATA;
goto fail;
}
@@ -1438,8 +1438,8 @@ static int mov_read_clap(MOVContext *c, AVIOContext *pb,
MOVAtom atom)
top = av_q2d(av_sub_q(pc_y, aperture_height));
bottom = av_q2d(av_add_q(pc_y, aperture_height));
- if (bottom > (height - 1) ||
- right > (width - 1)) {
+ if (top < 0 || bottom < 0 || bottom > (height - 1) ||
+ left < 0 || right < 0 || right > (width - 1)) {
err = AVERROR_INVALIDDATA;
goto fail;
}
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
