This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/5.1 in repository ffmpeg.
commit e07e06a08e3b8803de508e3eb1fb37fb46436c6a Author: Michael Niedermayer <[email protected]> AuthorDate: Thu Feb 12 23:10:32 2026 +0100 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 21 02:56:27 2026 +0200 avformat/flvdec: Check *size in cts parsing Fixes: Assertion buf_size >= 0 failed Fixes: 471553942/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5982849812725760 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 6ee3e59ce29c6142722930923f8d3d1b746657f8) Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 1b54363cc57a488a9d8d241aa66f969405a0541a) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/flvdec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index 7242296f7f..303a65f9f3 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -1250,6 +1250,10 @@ retry_duration: } if (st->codecpar->codec_id == AV_CODEC_ID_H264 || st->codecpar->codec_id == AV_CODEC_ID_MPEG4) { + if (size < 3) { + ret = AVERROR_INVALIDDATA; + goto leave; + } // sign extension int32_t cts = (avio_rb24(s->pb) + 0xff800000) ^ 0xff800000; pts = av_sat_add64(dts, cts); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
