This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new ae0e0ba3c3 avformat/mov: reject a trun sample count the input cannot
hold
ae0e0ba3c3 is described below
commit ae0e0ba3c3df840191e7a4c9b76494372ec53202
Author: Michael Niedermayer <[email protected]>
AuthorDate: Thu Jul 30 16:01:05 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Sun Aug 2 16:05:57 2026 +0000
avformat/mov: reject a trun sample count the input cannot hold
Fixes: OOM
Fixes:
525088811/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5229499332231168
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
---
libavformat/mov.c | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 6a43082cb3..5a66d572ee 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -6253,6 +6253,31 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb,
MOVAtom atom)
if (flags & MOV_TRUN_DATA_OFFSET) data_offset =
avio_rb32(pb);
if (flags & MOV_TRUN_FIRST_SAMPLE_FLAGS) first_sample_flags =
avio_rb32(pb);
+ int entry_size = !!(flags & MOV_TRUN_SAMPLE_DURATION) * 4
+ + !!(flags & MOV_TRUN_SAMPLE_SIZE) * 4
+ + !!(flags & MOV_TRUN_SAMPLE_FLAGS) * 4
+ + !!(flags & MOV_TRUN_SAMPLE_CTS) * 4;
+ int64_t sample_data_size = avio_size(sc->pb);
+ int64_t max_entries = INT64_MAX;
+
+ if (sample_data_size > 0)
+ max_entries = sample_data_size - sti->nb_index_entries;
+ if (entry_size) {
+ int64_t size = sc->pb == pb ? sample_data_size : avio_size(pb);
+ int64_t pos = avio_tell(pb);
+ int64_t left = atom.size - 8 - !!(flags & MOV_TRUN_DATA_OFFSET)
* 4
+ - !!(flags & MOV_TRUN_FIRST_SAMPLE_FLAGS)
* 4;
+
+ if (pos >= 0 && size >= pos)
+ left = FFMIN(left, size - pos);
+ max_entries = FFMIN(max_entries, left / entry_size);
+ }
+ if (entries > max_entries) {
+ av_log(c->fc, AV_LOG_ERROR, "trun sample count %u exceeds the
%"PRId64" "
+ "samples the input can hold\n", entries, max_entries);
+ return AVERROR_INVALIDDATA;
+ }
+
frag_stream_info = get_current_frag_stream_info(&c->frag_index);
if (frag_stream_info) {
if (frag_stream_info->next_trun_dts != AV_NOPTS_VALUE) {
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
