PR #23951 opened by ffmpeg-devel URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23951 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23951.patch
**Backport:** https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23946 The check on variable subblock durations in param_parse() has an inverted comparison operator. The current code: if (duration - total_duration > subblock_duration) checks "remaining > subblock", which is true for every non-final subblock in a multi-subblock parameter — causing valid IAMF files to be rejected. It also fails to catch the actual error case (subblock > remaining), allowing total_duration to exceed duration. Fix: swap the operands so the check correctly rejects subblocks that exceed the remaining duration. Found via formal verification modeling of the validation logic. From cfa62de001af8ffeb7e22561f246469c7b809951 Mon Sep 17 00:00:00 2001 From: almogyalin <[email protected]> Date: Wed, 29 Jul 2026 07:02:38 +0000 Subject: [PATCH] avformat/iamf_parse: fix inverted subblock duration validation The check on variable subblock durations had an inverted comparison, rejecting valid multi-subblock parameters and failing to catch subblock durations exceeding the remaining time. (cherry picked from commit 1635b49b80402c8cec39eefb12f35e2ee7c13606) --- libavformat/iamf_parse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index d74a8677d6..92c012ba72 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -668,7 +668,7 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb, if (constant_subblock_duration == 0) { subblock_duration = ffio_read_leb(pb); - if (duration - total_duration > subblock_duration) { + if (subblock_duration > duration - total_duration) { av_log(s, AV_LOG_ERROR, "Invalid subblock durations in parameter_id %u\n", parameter_id); av_free(param); return AVERROR_INVALIDDATA; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
