Hi On Thu, Apr 02, 2026 at 09:06:54AM +0000, joaocns0--- via ffmpeg-devel wrote: > Hi, > > When parsing infe version > 2, mov_read_infe() reads item_id as > 32-bit, so the fixed fields after the fullbox header consume 10 > bytes instead of 8. > > The current code still subtracts 8 from the remaining atom size. > As a result, the parsed item_name can consume 2 bytes past the end > of the infe box and into the following data in the iinf container. > > The patch below adjusts the size accounting for version > 2. > > Signed-off-by: João Neves <[email protected]> > > --- > libavformat/mov.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavformat/mov.c b/libavformat/mov.c > index dc9233b8a8..ada633b14f 100644 > --- a/libavformat/mov.c > +++ b/libavformat/mov.c > @@ -9068,7 +9068,7 @@ static int mov_read_infe(MOVContext *c, AVIOContext > *pb, MOVAtom atom) > item_id = version > 2 ? avio_rb32(pb) : avio_rb16(pb); > avio_rb16(pb); // item_protection_index > item_type = avio_rl32(pb); > - size -= 8; > + size -= version > 2 ? 10 : 8; > if (size < 1) > return AVERROR_INVALIDDATA;
this is not a valid patch [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Whats the most studid thing your enemy could do ? Blow himself up Whats the most studid thing you could do ? Give up your rights and freedom because your enemy blew himself up.
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
