This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 28c330d0f3f3301128cab541774924de9ca78e5b Author: James Almer <[email protected]> AuthorDate: Sun Feb 22 11:05:12 2026 -0300 Commit: James Almer <[email protected]> CommitDate: Mon Feb 23 00:43:50 2026 +0000 avformat/mov: abort if the queried item doesn't exist instead of overwriting it The check for item presence was insufficient as it would result in the last item in the array being overwritten if it existed even if the id didn't match. Fixes: Assertion ref failed at src/libavformat/mov.c:10649 Fixes: clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5312542695292928 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: James Almer <[email protected]> --- libavformat/mov.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 1a4450153f..1ae6c262c2 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8919,6 +8919,7 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) HEIFItem *item = NULL; int item_id = (version < 2) ? avio_rb16(pb) : avio_rb32(pb); int offset_type = (version > 0) ? avio_rb16(pb) & 0xf : 0; + int j; if (avio_feof(pb)) return AVERROR_INVALIDDATA; @@ -8942,7 +8943,7 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) base_offset > INT64_MAX - extent_offset) return AVERROR_INVALIDDATA; - for (int j = 0; j < c->nb_heif_item; j++) { + for (j = 0; j < c->nb_heif_item; j++) { item = c->heif_item[j]; if (!item) item = c->heif_item[j] = av_mallocz(sizeof(*item)); @@ -8952,6 +8953,8 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) } if (!item) return AVERROR(ENOMEM); + if (j == c->nb_heif_item) + return AVERROR_INVALIDDATA; item->item_id = item_id; @@ -8975,7 +8978,7 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom) int64_t size = atom.size; uint32_t item_type; int item_id; - int version, ret; + int i, version, ret; version = avio_r8(pb); avio_rb24(pb); // flags. @@ -9010,7 +9013,7 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (size > 0) avio_skip(pb, size); - for (int i = 0; i < c->nb_heif_item; i++) { + for (i = 0; i < c->nb_heif_item; i++) { item = c->heif_item[i]; if (!item) item = c->heif_item[i] = av_mallocz(sizeof(*item)); @@ -9022,6 +9025,8 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom) av_bprint_finalize(&item_name, NULL); return AVERROR(ENOMEM); } + if (i == c->nb_heif_item) + return AVERROR_INVALIDDATA; av_freep(&item->name); av_bprint_finalize(&item_name, ret ? &item->name : NULL); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
