This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 65b0dab903 avformat/dashdec: reject a negative fragment index
65b0dab903 is described below
commit 65b0dab903e5975e036b30ecc58f5935d4f151e0
Author: Joshua Rogers <[email protected]>
AuthorDate: Tue Aug 4 12:11:55 2026 +0000
Commit: michaelni <[email protected]>
CommitDate: Tue Aug 11 21:37:54 2026 +0000
avformat/dashdec: reject a negative fragment index
A live manifest whose startNumber decreases across a refresh drives
cur_seq_no negative in move_segments(); get_current_fragment() only checked
the upper bound before indexing fragments[]. Add a lower-bound check and
clamp the negative delta at its source.
Fixes: out of array read
---
libavformat/dashdec.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index d4a05ace7e..740ac6bc1c 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -1537,8 +1537,11 @@ static void move_segments(struct representation
*rep_src, struct representation
free_fragment_list(rep_dest);
if (rep_src->start_number > (rep_dest->start_number +
rep_dest->n_fragments))
rep_dest->cur_seq_no = 0;
- else
+ else {
rep_dest->cur_seq_no += rep_src->start_number -
rep_dest->start_number;
+ if (rep_dest->cur_seq_no < 0)
+ rep_dest->cur_seq_no = 0;
+ }
rep_dest->fragments = rep_src->fragments;
rep_dest->n_fragments = rep_src->n_fragments;
rep_dest->parent = rep_src->parent;
@@ -1658,7 +1661,7 @@ static struct fragment *get_current_fragment(struct
representation *pls)
int reload_count = 0;
while (( !ff_check_interrupt(c->interrupt_callback)&& pls->n_fragments >
0)) {
- if (pls->cur_seq_no < pls->n_fragments) {
+ if (pls->cur_seq_no >= 0 && pls->cur_seq_no < pls->n_fragments) {
seg_ptr = pls->fragments[pls->cur_seq_no];
seg = av_mallocz(sizeof(struct fragment));
if (!seg) {
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
