PR #25051 opened by Marvin Scholz (ePirat) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25051 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25051.patch
`horiz_off.num` and `vert_off.num` are signed integers and may be negative, which can make the calculated top, bottom, left, or right crop coordinates negative before bounds checking. Casting a negative double to `uint64_t` is undefined behavior. Additionally, zero denominators for the rational values were not rejected. Use `int64_t` for top, bottom, left, and right, reject zero denominators, and check for negative coordinates. >From 7aa63c473d7677b604998ceda86fd1ce9b3f4c52 Mon Sep 17 00:00:00 2001 From: Marvin Scholz <[email protected]> Date: Thu, 1 Oct 2026 16:34:37 +0000 Subject: [PATCH] avformat/mov: prevent float-cast-overflow in mov_read_clap horiz_off.num and vert_off.num are signed integers and may be negative, which can make the calculated top, bottom, left, or right crop coordinates negative before bounds checking. Casting a negative double to uint64_t is undefined behavior. Additionally, zero denominators for the rational values were not rejected. Use int64_t for top, bottom, left, and right, reject zero denominators, and check for negative coordinates. Signed-off-by: Marvin Scholz <[email protected]> --- libavformat/mov.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 85e28f45f8..aed86cc088 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -1378,7 +1378,7 @@ static int mov_read_clap(MOVContext *c, AVIOContext *pb, MOVAtom atom) int width, height, err = 0; AVRational aperture_width, aperture_height, horiz_off, vert_off; AVRational pc_x, pc_y; - uint64_t top, bottom, left, right; + int64_t top, bottom, left, right; item = get_heif_item(c, c->cur_item_id); st = get_curr_st(c); @@ -1406,9 +1406,9 @@ static int mov_read_clap(MOVContext *c, AVIOContext *pb, MOVAtom atom) vert_off.num = avio_rb32(pb); vert_off.den = avio_rb32(pb); - if (aperture_width.num < 0 || aperture_width.den < 0 || - aperture_height.num < 0 || aperture_height.den < 0 || - horiz_off.den < 0 || vert_off.den < 0) { + if (aperture_width.num < 0 || aperture_width.den <= 0 || + aperture_height.num < 0 || aperture_height.den <= 0 || + horiz_off.den <= 0 || vert_off.den <= 0) { err = AVERROR_INVALIDDATA; goto fail; } @@ -1437,8 +1437,8 @@ static int mov_read_clap(MOVContext *c, AVIOContext *pb, MOVAtom atom) top = av_q2d(av_sub_q(pc_y, aperture_height)); bottom = av_q2d(av_add_q(pc_y, aperture_height)); - if (bottom > (height - 1) || - right > (width - 1)) { + if (top < 0 || bottom < 0 || bottom > (height - 1) || + left < 0 || right < 0 || right > (width - 1)) { err = AVERROR_INVALIDDATA; goto fail; } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
