PR #22758 opened by joaonevess URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22758 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22758.patch
When version == 0, default_length is 0 and the per-entry description_length read is skipped (guarded by version >= 1). After reading the 1-byte NAL unit type, description_length -= 1 wraps the uint32_t from 0 to 0xFFFFFFFF, causing avio_skip to attempt a ~4GB seek. Guard the subtraction so it only executes when description_length is nonzero. Signed-off-by: João Neves <[email protected]> From 0dc80c665ee1516ef5368aff49c13094ce44001c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Neves?= <[email protected]> Date: Wed, 8 Apr 2026 13:56:06 -0700 Subject: [PATCH] avformat/mov: fix uint32 underflow in mov_read_sgpd MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When version == 0, default_length is 0 and the per-entry description_length read is skipped (guarded by version >= 1). After reading the 1-byte NAL unit type, description_length -= 1 wraps the uint32_t from 0 to 0xFFFFFFFF, causing avio_skip to attempt a ~4GB seek. Guard the subtraction so it only executes when description_length is nonzero. Signed-off-by: João Neves <[email protected]> --- libavformat/mov.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index dc9233b8a8..14803f2f3f 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3849,7 +3849,8 @@ static int mov_read_sgpd(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (grouping_type == MKTAG('s','y','n','c')) { const uint8_t nal_unit_type = avio_r8(pb) & 0x3f; sc->sgpd_sync[i] = nal_unit_type; - description_length -= 1; + if (description_length > 0) + description_length -= 1; } avio_skip(pb, description_length); } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
