This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit c80d3b35aeb70a0beeec2af3b769775ea98cac30 Author: Marton Balint <[email protected]> AuthorDate: Thu Dec 25 20:03:32 2025 +0100 Commit: Marton Balint <[email protected]> CommitDate: Mon Jan 12 00:47:20 2026 +0100 avformat/aviobuf: return error for ffio_close_null_buf() if written bytes exceed INT_MAX Also check return value where it is used. Signed-off-by: Marton Balint <[email protected]> --- libavformat/avio_internal.h | 2 +- libavformat/aviobuf.c | 4 +++- libavformat/movenc.c | 7 ++++++- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/libavformat/avio_internal.h b/libavformat/avio_internal.h index 7d4756db0c..fadf19dae5 100644 --- a/libavformat/avio_internal.h +++ b/libavformat/avio_internal.h @@ -259,7 +259,7 @@ int ffio_open_whitelist(AVIOContext **s, const char *url, int flags, * Close a null buffer. * * @param s an IO context opened by ffio_open_null_buf - * @return the number of bytes written to the null buffer + * @return the number of bytes written to the null buffer, negative on error */ int ffio_close_null_buf(AVIOContext *s); diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index 9beac8bcd5..373a48eea5 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -1451,6 +1451,8 @@ static int null_buf_write(void *opaque, const uint8_t *buf, int buf_size) { DynBuffer *d = opaque; + if ((unsigned)d->pos + (unsigned)buf_size > INT_MAX) + return AVERROR(ERANGE); d->pos += buf_size; if (d->pos > d->size) d->size = d->pos; @@ -1474,7 +1476,7 @@ int ffio_close_null_buf(AVIOContext *s) avio_flush(s); - size = d->size; + size = s->error ? s->error : d->size; avio_context_free(&s); diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 8d8acd2aff..e844be483c 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -5845,8 +5845,11 @@ static int mov_write_sidx_tags(AVIOContext *pb, MOVMuxContext *mov, total_size -= mov_write_sidx_tag(avio_buf, track, ref_size, total_size); } - if (round == 0) + if (round == 0) { total_size = ffio_close_null_buf(avio_buf); + if (total_size < 0) + return total_size; + } } return 0; } @@ -5911,6 +5914,8 @@ static int mov_write_moof_tag(AVIOContext *pb, MOVMuxContext *mov, int tracks, return ret; mov_write_moof_tag_internal(avio_buf, mov, tracks, 0); moof_size = ffio_close_null_buf(avio_buf); + if (moof_size < 0) + return moof_size; if (mov->flags & FF_MOV_FLAG_DASH && !(mov->flags & (FF_MOV_FLAG_GLOBAL_SIDX | FF_MOV_FLAG_SKIP_SIDX))) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
