This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch release/4.4
in repository ffmpeg.

commit a2f90b6dc935bc25716f6fa07cc41d0581b3b321
Author:     Ted Meyer <[email protected]>
AuthorDate: Tue Mar 3 12:52:25 2026 -0800
Commit:     Michael Niedermayer <[email protected]>
CommitDate: Tue May 5 18:55:09 2026 +0200

    avformat/mov: Handle integer overflow in MOV parser
    
    A chromium UBSAN fuzzer caught this instance.
    
    (cherry picked from commit fc7cab6be30b3dde0fd80cc122995c099dfac4e2)
    Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavformat/mov.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 03a19abd4b..0a83ec3116 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -3599,7 +3599,12 @@ static void mov_fix_index(MOVContext *mov, AVStream *st)
                st->index, edit_list_index, edit_list_media_time, 
edit_list_duration);
         edit_list_index++;
         edit_list_dts_counter = edit_list_dts_entry_end;
-        edit_list_dts_entry_end += edit_list_duration;
+        edit_list_dts_entry_end = av_sat_add64(edit_list_dts_entry_end, 
edit_list_duration);
+        if (edit_list_dts_entry_end == INT64_MAX) {
+            av_log(mov->fc, AV_LOG_ERROR, "Cannot calculate dts entry length 
with duration %"PRId64"\n",
+                   edit_list_duration);
+            break;
+        }
         num_discarded_begin = 0;
         if (!found_non_empty_edit && edit_list_media_time == -1) {
             empty_edits_sum_duration += edit_list_duration;

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to