PR #23750 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23750 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23750.patch
the code later treated EOF non fatally and just continues with a truncated list, this mirrors this Fixes: OOM Fixes: 525088811/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5229499332231168 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg >From 6efafb6833f9b98aab3b679faa4148960cdeec66 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 7 Jul 2026 23:41:53 +0200 Subject: [PATCH] avformat/mov: clamp trun sample count to what the input can hold the code later treated EOF non fatally and just continues with a truncated list, this mirrors this Fixes: OOM Fixes: 525088811/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5229499332231168 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg --- libavformat/mov.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 4154038d9e..7e6b905ff5 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -6002,6 +6002,19 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom) entries = avio_rb32(pb); av_log(c->fc, AV_LOG_TRACE, "flags 0x%x entries %u\n", flags, entries); + int entry_size = !!(flags & MOV_TRUN_SAMPLE_DURATION) * 4 + + !!(flags & MOV_TRUN_SAMPLE_SIZE) * 4 + + !!(flags & MOV_TRUN_SAMPLE_FLAGS) * 4 + + !!(flags & MOV_TRUN_SAMPLE_CTS) * 4; + int64_t size = avio_size(pb); + int64_t pos = avio_tell(pb); + if (size >= 0 && pos >= 0 && pos <= size) { + uint64_t max_entries = entry_size ? (uint64_t)(size - pos) / entry_size + : (uint64_t)size; + if (entries > max_entries) + entries = max_entries; + } + if ((uint64_t)entries+sc->tts_count >= UINT_MAX/sizeof(*sc->tts_data)) return AVERROR_INVALIDDATA; if (flags & MOV_TRUN_DATA_OFFSET) data_offset = avio_rb32(pb); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
