This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 3b28a08a32 avformat/wavdec: fix integer overflow in W64 chunk size
check
3b28a08a32 is described below
commit 3b28a08a32c3599410c7f7cd3c1032c58f34dbe0
Author: Michael Niedermayer <[email protected]>
AuthorDate: Fri Jul 3 04:47:13 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Sun Jul 5 00:00:07 2026 +0000
avformat/wavdec: fix integer overflow in W64 chunk size check
Fixes:
523658585/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5454488994643968
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/wavdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c
index b980bebf0e..247681e265 100644
--- a/libavformat/wavdec.c
+++ b/libavformat/wavdec.c
@@ -908,7 +908,7 @@ static int w64_read_header(AVFormatContext *s)
if (avio_read(pb, guid, 16) != 16)
break;
size = avio_rl64(pb);
- if (size <= 24 || INT64_MAX - size < avio_tell(pb)) {
+ if (size <= 24 || INT64_MAX - size - 7 < avio_tell(pb)) {
if (data_ofs)
break;
return AVERROR_INVALIDDATA;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
