This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.1 in repository ffmpeg.
commit 62d4ca1f3ead52ac45c9ceae761e0139f42bfd4b Author: Joshua Rogers <[email protected]> AuthorDate: Tue Aug 4 12:11:55 2026 +0000 Commit: Michael Niedermayer <[email protected]> CommitDate: Sat Sep 19 14:27:06 2026 +0200 avformat/dashdec: reject a negative fragment index A live manifest whose startNumber decreases across a refresh drives cur_seq_no negative in move_segments(); get_current_fragment() only checked the upper bound before indexing fragments[]. Add a lower-bound check and clamp the negative delta at its source. Fixes: out of array read (cherry picked from commit 65b0dab903e5975e036b30ecc58f5935d4f151e0) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/dashdec.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c index 32f73ba2d7..b1d099dea8 100644 --- a/libavformat/dashdec.c +++ b/libavformat/dashdec.c @@ -1507,8 +1507,11 @@ static void move_segments(struct representation *rep_src, struct representation free_fragment_list(rep_dest); if (rep_src->start_number > (rep_dest->start_number + rep_dest->n_fragments)) rep_dest->cur_seq_no = 0; - else + else { rep_dest->cur_seq_no += rep_src->start_number - rep_dest->start_number; + if (rep_dest->cur_seq_no < 0) + rep_dest->cur_seq_no = 0; + } rep_dest->fragments = rep_src->fragments; rep_dest->n_fragments = rep_src->n_fragments; rep_dest->parent = rep_src->parent; @@ -1628,7 +1631,7 @@ static struct fragment *get_current_fragment(struct representation *pls) int reload_count = 0; while (( !ff_check_interrupt(c->interrupt_callback)&& pls->n_fragments > 0)) { - if (pls->cur_seq_no < pls->n_fragments) { + if (pls->cur_seq_no >= 0 && pls->cur_seq_no < pls->n_fragments) { seg_ptr = pls->fragments[pls->cur_seq_no]; seg = av_mallocz(sizeof(struct fragment)); if (!seg) { -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
