PR #25592 opened by ffmpeg-devel URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25592 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25592.patch
**Backport:** https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25050 Reset `matroska->duration` to 0 if it is negative or if `matroska->duration * matroska->time_scale` would exceed `INT64_MAX`, preventing a float-cast-overflow when calculating the duration. >From 813ebee948d5b11cdf092dd3ef5395989152a486 Mon Sep 17 00:00:00 2001 From: Marvin Scholz <[email protected]> Date: Tue, 29 Sep 2026 13:00:40 +0000 Subject: [PATCH] avformat/matroskadec: prevent duration float-cast-overflow Reset matroska->duration to 0 if it is negative or if matroska->duration * matroska->time_scale would exceed INT64_MAX, preventing a float-cast-overflow when calculating the duration. Signed-off-by: Marvin Scholz <[email protected]> (cherry picked from commit d42f8d8767cb0d11fdbd5bf7c3dc2e426f97b3ca) --- libavformat/matroskadec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index b793f67fa07..d36cc5c3452 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -3506,7 +3506,8 @@ static int matroska_read_header(AVFormatContext *s) if (!matroska->time_scale) matroska->time_scale = 1000000; - if (isnan(matroska->duration)) + if (isnan(matroska->duration) || matroska->duration < 0 || + matroska->duration >= (double)INT64_MAX / matroska->time_scale) matroska->duration = 0; if (matroska->duration) matroska->ctx->duration = matroska->duration * matroska->time_scale * -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
