This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 35f8f4bdc0 avformat/wavdec: limit memory allocated for BEXT coding
history data
35f8f4bdc0 is described below
commit 35f8f4bdc075db1ae63d999edf7ae682fcaf3cf7
Author: Tobias Rapp <[email protected]>
AuthorDate: Fri Jul 10 11:43:40 2026 +0200
Commit: Tobias Rapp <[email protected]>
CommitDate: Fri Jul 10 12:12:54 2026 +0200
avformat/wavdec: limit memory allocated for BEXT coding history data
Avoid excessive memory allocation when parsing coding history data from
BWF/WAV files by using a size limit of 1MB. When the chunk size limit is
exceeded read fails with an error log message.
Patch-by: Leander-Amz in
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20642#issuecomment-48126
---
libavformat/wavdec.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c
index 247681e265..8e09e1ac5a 100644
--- a/libavformat/wavdec.c
+++ b/libavformat/wavdec.c
@@ -323,17 +323,25 @@ static int wav_parse_bext_tag(AVFormatContext *s, int64_t
size)
if (size > 602) {
/* CodingHistory present */
- size -= 602;
+ int64_t coding_history_size = size - 602;
- if (!(coding_history = av_malloc(size + 1)))
+ /* Professional BEXT coding history rarely exceeds a few KB.
+ * Cap to 1MB to prevent excessive allocation from crafted files
+ * while remaining well within ffio_read_size's int range. */
+ if (coding_history_size > 1024 * 1024) {
+ av_log(s, AV_LOG_ERROR, "BEXT coding history too large
(%"PRId64")\n", coding_history_size);
+ return AVERROR_INVALIDDATA;
+ }
+
+ if (!(coding_history = av_malloc(coding_history_size + 1)))
return AVERROR(ENOMEM);
- if ((ret = ffio_read_size(s->pb, coding_history, size)) < 0) {
+ if ((ret = ffio_read_size(s->pb, coding_history, coding_history_size))
< 0) {
av_free(coding_history);
return ret;
}
- coding_history[size] = 0;
+ coding_history[coding_history_size] = 0;
if ((ret = av_dict_set(&s->metadata, "coding_history", coding_history,
AV_DICT_DONT_STRDUP_VAL)) < 0)
return ret;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
