PR #25230 opened by Scott Kidder (skidder) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25230 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25230.patch
# Summary of changes A crafted file can declare an arbitrarily large constant sample count, forcing unbounded index and timing table allocations from a tiny input (CWE-400). This change adds `MOV_MAX_SAMPLE_COUNT` (4,194,304, ~27 hours of AAC) as a hard cap before the preallocation, bounding worst-case transient memory to ~151 MB. With these changes the same input is rejected instantly at ~6 MB RSS; benign AAC/M4A and constant-stsz PCM files demux unchanged. Fixes https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/25229 >From 982bdea9092e32c2c5fee484c9b85103c3b6de60 Mon Sep 17 00:00:00 2001 From: Scott Kidder <[email protected]> Date: Mon, 19 Oct 2026 17:11:31 -0700 Subject: [PATCH] avformat/mov: cap sample count in mov_build_index A crafted file can declare an arbitrarily large constant sample count, forcing unbounded index and timing table allocations from a tiny input (CWE-400). --- libavformat/mov.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 79bbdb05692..c38e959aa3f 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -4980,6 +4980,8 @@ static int mov_merge_tts_data(MOVContext *mov, AVStream *st, int flags) return 0; } +#define MOV_MAX_SAMPLE_COUNT 4194304 + static void mov_build_index(MOVContext *mov, AVStream *st) { MOVStreamContext *sc = st->priv_data; @@ -5066,6 +5068,8 @@ static void mov_build_index(MOVContext *mov, AVStream *st) return; if (sc->sample_count >= UINT_MAX / sizeof(*sti->index_entries) - sti->nb_index_entries) return; + if (sc->sample_count > MOV_MAX_SAMPLE_COUNT) + return; if (av_reallocp_array(&sti->index_entries, sti->nb_index_entries + sc->sample_count, sizeof(*sti->index_entries)) < 0) { -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
