This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit c7132ef8f63c383d11a00a9e3034748d8dd15fb3 Author: Joshua Rogers <[email protected]> AuthorDate: Tue Aug 4 12:11:56 2026 +0000 Commit: Michael Niedermayer <[email protected]> CommitDate: Wed Aug 12 04:51:59 2026 +0200 avformat/hevc: reject hvcC NAL arrays that overflow the 16-bit count numNalus is uint16_t; a crafted hvcC declaring >65535 NAL units of one type wraps it to 0 and then writes nal[-1]. Reject before the count can wrap. Reachable by remuxing a crafted file with -c copy. Fixes: integer overflow Fixes: out of array access (cherry picked from commit acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/hevc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/hevc.c b/libavformat/hevc.c index 5924f39503..2cd7b1cd89 100644 --- a/libavformat/hevc.c +++ b/libavformat/hevc.c @@ -844,6 +844,9 @@ static int hvcc_array_add_nal_unit(const uint8_t *nal_buf, uint32_t nal_size, int ret; uint16_t numNalus = array->numNalus; + if (numNalus >= UINT16_MAX) + return AVERROR_INVALIDDATA; + ret = av_reallocp_array(&array->nal, numNalus + 1, sizeof(*array->nal)); if (ret < 0) return ret; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
