This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch release/9.0
in repository ffmpeg.

commit dd22741d7129b49ae3870ac4167188699a371b02
Author:     Michael Niedermayer <[email protected]>
AuthorDate: Wed Jul 22 06:17:01 2026 +0200
Commit:     Michael Niedermayer <[email protected]>
CommitDate: Sun Aug 2 02:47:30 2026 +0200

    avformat/mov: bound sgpd sync entry_count by the atom size
    
    Fixes: unbounded allocation
    Fixes: ffmpeg-sgpd-sync-entry-count-alloc.mp4
    Fixes: 4f7OaHqbUKh2
    Found-by: Brian Lee, Youngjoon Kim (Georgia Tech SSLab)
    (cherry picked from commit a100d346dafd012bfc0c20098a764c6d01a05714)
    Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavformat/mov.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 98e5e4de9a..508ea97637 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -3949,6 +3949,9 @@ static int mov_read_sgpd(MOVContext *c, AVIOContext *pb, 
MOVAtom atom)
     default_group_description_index = version >= 2 ? avio_rb32(pb) : 0;
     entry_count = avio_rb32(pb);
 
+    if (entry_count > atom.size)
+        return AVERROR_INVALIDDATA;
+
     av_freep(&sc->sgpd_sync);
     sc->sgpd_sync_count = entry_count;
     sc->sgpd_sync = av_calloc(entry_count, sizeof(*sc->sgpd_sync));

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to