This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit dd22741d7129b49ae3870ac4167188699a371b02 Author: Michael Niedermayer <[email protected]> AuthorDate: Wed Jul 22 06:17:01 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Aug 2 02:47:30 2026 +0200 avformat/mov: bound sgpd sync entry_count by the atom size Fixes: unbounded allocation Fixes: ffmpeg-sgpd-sync-entry-count-alloc.mp4 Fixes: 4f7OaHqbUKh2 Found-by: Brian Lee, Youngjoon Kim (Georgia Tech SSLab) (cherry picked from commit a100d346dafd012bfc0c20098a764c6d01a05714) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 98e5e4de9a..508ea97637 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3949,6 +3949,9 @@ static int mov_read_sgpd(MOVContext *c, AVIOContext *pb, MOVAtom atom) default_group_description_index = version >= 2 ? avio_rb32(pb) : 0; entry_count = avio_rb32(pb); + if (entry_count > atom.size) + return AVERROR_INVALIDDATA; + av_freep(&sc->sgpd_sync); sc->sgpd_sync_count = entry_count; sc->sgpd_sync = av_calloc(entry_count, sizeof(*sc->sgpd_sync)); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
