This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit bbf6a552eb58e91bacd70d0b5f3d0fbdbf82f017 Author: zhang xingxing <[email protected]> AuthorDate: Fri Nov 6 02:04:07 2026 +0100 Commit: michaelni <[email protected]> CommitDate: Sun Nov 8 15:37:01 2026 +0000 avformat/bink: reject frames too small for the audio size field Fixes: integer underflow Fixes: x58AlI4Komta Fixes: swarm-Underflow-in-remain_packet_size-check-in-Bink-read_packet-391e16 Found-by: zhang xingxing <[email protected]> Unsigned underflow Replicated through UnModified FFmpeg with ffprobe Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/bink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/bink.c b/libavformat/bink.c index 18eaeba738..6becc59031 100644 --- a/libavformat/bink.c +++ b/libavformat/bink.c @@ -263,7 +263,7 @@ static int read_packet(AVFormatContext *s, AVPacket *pkt) while (bink->current_track < bink->num_audio_tracks) { uint32_t audio_size = avio_rl32(pb); - if (audio_size > bink->remain_packet_size - 4) { + if (audio_size + 4LL > bink->remain_packet_size) { av_log(s, AV_LOG_ERROR, "frame %"PRId64": audio size in header (%"PRIu32") > size of packet left (%"PRIu32")\n", bink->video_pts, audio_size, bink->remain_packet_size); -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
