This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch release/4.4
in repository ffmpeg.

commit d9cd65997973ce6dfb0f285ed2e78fc5ed1e3034
Author:     depthfirst-dev[bot] 
<1012587+depthfirst-dev[bot]@users.noreply.github.com>
AuthorDate: Thu Apr 23 02:47:11 2026 +0000
Commit:     Michael Niedermayer <[email protected]>
CommitDate: Tue May 5 18:55:13 2026 +0200

    avformat/cafdec: fix negative index use in read_seek
    
    av_index_search_timestamp() returns a negative value when a seek target
    cannot be resolved from the stream index. Bail out before using that
    result as an index into sti->index_entries to avoid out-of-bounds reads.
    
    Fixes: Buffer underflow
    
    Fixes: DFVULN-608
    
    *Vulnerability reported by Zhenpeng (Leo) Lin at depthfirst*
    *Patch validated by Zheng Yu at depthfirst*
    
    (cherry picked from commit 5408059eb7f2ff628ba25db7ff8714e707467c49)
    Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavformat/cafdec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c
index 5247ca45ca..ec27c87221 100644
--- a/libavformat/cafdec.c
+++ b/libavformat/cafdec.c
@@ -451,6 +451,8 @@ static int read_seek(AVFormatContext *s, int stream_index,
         frame_cnt  = caf->frames_per_packet * packet_cnt;
     } else if (st->nb_index_entries) {
         packet_cnt = av_index_search_timestamp(st, timestamp, flags);
+        if (packet_cnt < 0)
+            return -1;
         frame_cnt  = st->index_entries[packet_cnt].timestamp;
         pos        = st->index_entries[packet_cnt].pos;
     } else {

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to