PR #23946 opened by almogyalin
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23946
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23946.patch
The check on variable subblock durations in param_parse() has an inverted
comparison operator. The current code:
if (duration - total_duration > subblock_duration)
checks "remaining > subblock", which is true for every non-final subblock
in a multi-subblock parameter — causing valid IAMF files to be rejected.
It also fails to catch the actual error case (subblock > remaining),
allowing total_duration to exceed duration.
Fix: swap the operands so the check correctly rejects subblocks that
exceed the remaining duration.
Found via formal verification modeling of the validation logic.
From 1635b49b80402c8cec39eefb12f35e2ee7c13606 Mon Sep 17 00:00:00 2001
From: almogyalin <[email protected]>
Date: Wed, 29 Jul 2026 07:02:38 +0000
Subject: [PATCH] avformat/iamf_parse: fix inverted subblock duration
validation
The check on variable subblock durations had an inverted comparison, rejecting
valid multi-subblock parameters and failing to catch subblock durations
exceeding the remaining time.
---
libavformat/iamf_parse.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 4c2df2c9e6..37d7e04f7b 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -668,7 +668,7 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext
*pb,
if (constant_subblock_duration == 0) {
subblock_duration = ffio_read_leb(pb);
- if (duration - total_duration > subblock_duration) {
+ if (subblock_duration > duration - total_duration) {
av_log(s, AV_LOG_ERROR, "Invalid subblock durations in
parameter_id %u\n", parameter_id);
av_free(param);
return AVERROR_INVALIDDATA;
--
2.52.0
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
