From 6d27f78166b5a46466155389f822efe27383d777 Mon Sep 17 00:00:00 2001 From: Hardik-369 Date: Sun, 5 Jul 2026 10:39:35 +0530 Subject: [PATCH 3/3] avformat/asf: replace debug-only assert with runtime check The av_assert0() macro is only active in debug builds. In optimized builds, the unchecked multiplication 2 * len could overflow, producing an undersized heap allocation. Replace with a runtime check. Signed-off-by: Siddharth --- libavformat/asfdec_f.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index a1a0428..f1a05d5 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -225,7 +225,8 @@ static void get_tag(AVFormatContext *s, const char *key, int type, int len) int64_t off = avio_tell(s->pb); #define LEN 22 - av_assert0((unsigned)len < (INT_MAX - LEN) / 2); + if ((unsigned)len >= (INT_MAX - LEN) / 2) + goto finish; if (!asf->export_xmp && !strncmp(key, "xmp", 3)) goto finish; -- 2.53.0.windows.1