PR #24606 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24606 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24606.patch
Fixes: letting a 180 byte file allocate and zero 2 GiB. Fixes: QaEym66QNGh3 Found-by: Mayank Jangid, OpenSec >From 5708f53e1560e22a92b6931fb0e7040893dce0b1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 21 Sep 2026 05:29:43 +0200 Subject: [PATCH] avformat/flvdec: bound the keyframe index arrays by the metadata tag size Fixes: letting a 180 byte file allocate and zero 2 GiB. Fixes: QaEym66QNGh3 Found-by: Mayank Jangid, OpenSec --- libavformat/flvdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index 03310503d1..e4bc8ebd83 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -551,7 +551,7 @@ static int parse_keyframes_index(AVFormatContext *s, AVIOContext *ioc, int64_t m break; arraylen = avio_rb32(ioc); - if (arraylen>>28) + if (arraylen>>28 || arraylen > (max_pos - avio_tell(ioc)) / 9) break; if (!strcmp(KEYFRAMES_TIMESTAMP_TAG , str_val) && !times) { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
