This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 6ee3e59ce2 avformat/flvdec: Check *size in cts parsing
6ee3e59ce2 is described below
commit 6ee3e59ce29c6142722930923f8d3d1b746657f8
Author: Michael Niedermayer <[email protected]>
AuthorDate: Thu Feb 12 23:10:32 2026 +0100
Commit: michaelni <[email protected]>
CommitDate: Sun Feb 15 06:37:19 2026 +0000
avformat/flvdec: Check *size in cts parsing
Fixes: Assertion buf_size >= 0 failed
Fixes:
471553942/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5982849812725760
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/flvdec.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c
index d10fbf216e..18bdbd18bd 100644
--- a/libavformat/flvdec.c
+++ b/libavformat/flvdec.c
@@ -1775,6 +1775,10 @@ retry_duration:
if (st->codecpar->codec_id == AV_CODEC_ID_MPEG4 ||
((st->codecpar->codec_id == AV_CODEC_ID_H264 ||
st->codecpar->codec_id == AV_CODEC_ID_HEVC) &&
(!enhanced_flv || type == PacketTypeCodedFrames))) {
+ if (size < 3 || track_size < 3) {
+ ret = AVERROR_INVALIDDATA;
+ goto leave;
+ }
// sign extension
int32_t cts = (avio_rb24(s->pb) + 0xff800000) ^ 0xff800000;
pts = av_sat_add64(dts, cts);
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
