This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.0 in repository ffmpeg.
commit f9b61216ae9357433d6a4d16dd37505a870462c9 Author: James Almer <[email protected]> AuthorDate: Sun Feb 22 11:12:23 2026 -0300 Commit: James Almer <[email protected]> CommitDate: Thu Mar 5 23:16:10 2026 -0300 avformat/mov: check for EOF in more loops Signed-off-by: James Almer <[email protected]> (cherry picked from commit c3aa28f23d5098b6ec2e8d537d4b9163c483a3ec) --- libavformat/mov.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 17782a614b..e39ddce99f 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -9097,8 +9097,13 @@ static int mov_read_iref_dimg(MOVContext *c, AVIOContext *pb, int version) if (!grid->tile_id_list || !grid->tile_item_list || !grid->tile_idx_list) return AVERROR(ENOMEM); /* 'to' item ids */ - for (i = 0; i < entries; i++) + for (i = 0; i < entries; i++) { grid->tile_id_list[i] = version ? avio_rb32(pb) : avio_rb16(pb); + + if (avio_feof(pb)) + return AVERROR_INVALIDDATA; + } + grid->nb_tiles = entries; grid->item = item; @@ -9125,6 +9130,10 @@ static int mov_read_iref_thmb(MOVContext *c, AVIOContext *pb, int version) /* 'to' item ids */ for (int i = 0; i < entries; i++) { HEIFItem *item = get_heif_item(c, version ? avio_rb32(pb) : avio_rb16(pb)); + + if (avio_feof(pb)) + return AVERROR_INVALIDDATA; + if (!item) { av_log(c->fc, AV_LOG_WARNING, "Missing stream referenced by thmb item\n"); continue; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
