This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.1 in repository ffmpeg.
commit 9992edfe9fe9667106035fc21350140c324a6e56 Author: He Huang <[email protected]> AuthorDate: Sat Sep 5 02:47:31 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sat Sep 19 14:27:14 2026 +0200 avformat/mov: bound the keys atom entry count by the atom size mov_read_keys() allocated (count + 1) pointers from the 32 bit entry count of the keys atom before reading a single key record, so a 56 byte file declaring 16777216 keys made ffprobe allocate and zero 128 MiB. Every key record takes at least 8 bytes, so a count above atom.size / 8 cannot be satisfied and is rejected before the allocation. Fixes: unbounded allocation Fixes: poc-keys-count-16777216.mp4 Fixes: hKO4f7GYoUd0 Found-by: He Huang, discovery assisted by NexusSan Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 67926e6667f84d98cc8d7cbb3eb77bc760155db4) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 3dbbb2ae97..6d79e20102 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -5374,7 +5374,7 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_skip(pb, 4); count = avio_rb32(pb); atom.size -= 8; - if (count >= UINT_MAX / sizeof(*c->meta_keys)) { + if (count > atom.size / 8 || count >= UINT_MAX / sizeof(*c->meta_keys)) { av_log(c->fc, AV_LOG_ERROR, "The 'keys' atom with the invalid key count: %"PRIu32"\n", count); return AVERROR_INVALIDDATA; -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
