From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 8B0694AF97 for ; Sun, 22 Feb 2026 14:17:08 +0000 (UTC) Authentication-Results: ffbox; dkim=fail (body hash mismatch (got b'F/bbauPxB9+5J2aFPUJQtgzNDae434hsjAUqUy4cQRc=', expected b'1eonAAkgxgzDqm6vn4Yts8PC7WpMjHkiQ4aKsyNQu+E=')) header.d=ffmpeg.org header.i=@ffmpeg.org header.a=rsa-sha256 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1771769799; h=mime-version : to : date : message-id : reply-to : subject : list-id : list-archive : list-archive : list-help : list-owner : list-post : list-subscribe : list-unsubscribe : from : cc : content-type : content-transfer-encoding : from; bh=F/bbauPxB9+5J2aFPUJQtgzNDae434hsjAUqUy4cQRc=; b=xFeCNSVfMl5DJUqIzQ8dwJtFKWzv8+FkX4K6nXboNVi1yo44BgrDDAsBAyQ1C6IPtvi5/ XMTWfUTwTz/EO/JaySbgmPo4pkO3XAoQljyPULCmDrZ8yd0L/8Z1VKG2jiW7xoTIJ+d7tkX sk79aQxVsodAqqV49x0JqaTBnZNmrYw27gKPlTgm8oym3owL1MBPLb2zX7GIB2Qw99lh9c3 fbvYuPHF7fFUjlhxFob4Rj1q4l1Use3YkEI5XUtqKVxg9jb24smd5KWn+oO+DSkVB+5C1LQ ZXLqBv9xfrgMLkheCTQxKVhnM6wVX2hTSVdpn1k5R7GjnguYsrJXnW+d12mw== Received: from [172.18.0.3] (unknown [172.18.0.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 4FA026912C5; Sun, 22 Feb 2026 16:16:39 +0200 (EET) ARC-Seal: i=1; cv=none; a=rsa-sha256; d=ffmpeg.org; s=arc; t=1771769750; b=nWf7D4XeLs3PGgJ1fHj6yo92jO5M4OtpAfeBtaq66998g4g1ukT6jFGANShK70y+eDSIe Yh3brxiTosces14xutORpFjfta73eQaRztMQq8qtBepWFxWPgNty2lPR4SacY+R2UrXqQsj mgwzY76Sfda9bw3CEbGUqcFCJEr3VOQ5sA5WRZcGUS2te4hR7TI3zoXOuwPIHPfg5c233rM huj/LL5BpTwNBjd3o1OCGPgDquq3PgkyVwsYlHOudZddQWRAL7/ha3Ytr1HTJ/GiRzM4ymR krplUYE4iqtkDPSaRkxa5rXIM/rQNGq/X6SmPPkz9/9eBcqgIXGBZ603LjoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=ffmpeg.org; s=arc; t=1771769750; h=from : sender : reply-to : subject : date : message-id : to : cc : mime-version : content-type : content-transfer-encoding : content-id : content-description : resent-date : resent-from : resent-sender : resent-to : resent-cc : resent-message-id : in-reply-to : references : list-id : list-help : list-unsubscribe : list-subscribe : list-post : list-owner : list-archive; bh=aCMwsGrw+eXikVXu04wn9VRU9/kO9WvZdtmEgNSEuhg=; b=cZ64xtyG73aaX5TjhzTcXjonlIrdszL/RewsjDDvBKmGSo3BRoSjTG3qJUW5GA8detCDB IuGbI0oajVuWa09kYJWWtAEs7zeW8HoYBfv66UjKcqhLQJMiFkI3SWFgJgWz4vArVZgg7u9 Axy/K2nmHK8SHthz3uAeFKlNg6e4ZqKxB5jDdp/7c5+lQucfXheqmtj9Pz4WUldnLcyVMiv /ZMpLoNSbdJBCSSvaHsfIkBUQG/vH0hSDo/rnYdXz6MX/syYnBp/Yf4JK2smnhFh4G/nn9c fTQMiyLsY71KA64WIus4zFaLnHEsOiF2y0Wjci0/cEiawSWPujJN+OQiDkbA== ARC-Authentication-Results: i=1; ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none; dmarc=pass header.from=ffmpeg.org policy.dmarc=quarantine Authentication-Results: ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none (Message is not ARC signed); dmarc=pass (Used From Domain Record) header.from=ffmpeg.org policy.dmarc=quarantine DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1771769370; h=content-type : mime-version : content-transfer-encoding : from : to : reply-to : subject : date : from; bh=1eonAAkgxgzDqm6vn4Yts8PC7WpMjHkiQ4aKsyNQu+E=; b=36qyolgRdaAQFJ6gW15a4ilbCbwZCgzKg8jY8S8T25PQVIG0tqMWJYPJDDIM01yvUVZx/ ieuIvvN6OXX7So+N9oBGPUwFDguNJlExX9RQy8UIe0FmViVLbw60JRbOhFpisbVigeICB9j UyGK5WT/fjTd/tnnAl26j7xzcholRBlYPY5isGwlkqltF3RNWLbKSSQMtUmFCOFaJLra/mS 2PyZ8cKG7Yna7ypiFa32wHFV45XivXdPlB1EvSQkcyWhzurnun+I2dBemDKpGZ8a5aE5vf5 615X/+478H6PKIVwIOuAg7Of/MXm1Q+A8+GEYTKt+aPVVPLMFxVG6SAD3wRg== MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Date: Sun, 22 Feb 2026 14:08:39 -0000 Message-ID: <177176967970.25.16240205457621635310@29965ddac10e> Message-ID-Hash: 3O72LNOVDO27FI2AJXWJYYQ5NXQVPGWG X-Message-ID-Hash: 3O72LNOVDO27FI2AJXWJYYQ5NXQVPGWG X-MailFrom: code@ffmpeg.org X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-ffmpeg-devel.ffmpeg.org-0; header-match-ffmpeg-devel.ffmpeg.org-1; header-match-ffmpeg-devel.ffmpeg.org-2; header-match-ffmpeg-devel.ffmpeg.org-3; emergency; member-moderation X-Mailman-Version: 3.3.10 Precedence: list Reply-To: FFmpeg development discussions and patches Subject: [FFmpeg-devel] [PR] avformat/mov: abort if the queried item doesn't exist instead of overwriting it (PR #22252) List-Id: FFmpeg development discussions and patches Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: James Almer via ffmpeg-devel Cc: James Almer Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Archived-At: List-Archive: List-Post: PR #22252 opened by James Almer (jamrial) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22252 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22252.patch The check for item presence was insufficient as it would result in the last item in the array being overwritten if it existed even if the id didn't match. >>From f1291b8c003289fda6da59491619576a62d2c1cf Mon Sep 17 00:00:00 2001 From: James Almer Date: Sun, 22 Feb 2026 11:05:12 -0300 Subject: [PATCH] avformat/mov: abort if the queried item doesn't exist instead of overwriting it The check for item presence was insufficient as it would result in the last item in the array being overwritten if it existed even if the id didn't match. Fixes: Assertion ref failed at src/libavformat/mov.c:10649 Fixes: clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5312542695292928 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: James Almer --- libavformat/mov.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 1a4450153f..1ae6c262c2 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8919,6 +8919,7 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) HEIFItem *item = NULL; int item_id = (version < 2) ? avio_rb16(pb) : avio_rb32(pb); int offset_type = (version > 0) ? avio_rb16(pb) & 0xf : 0; + int j; if (avio_feof(pb)) return AVERROR_INVALIDDATA; @@ -8942,7 +8943,7 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) base_offset > INT64_MAX - extent_offset) return AVERROR_INVALIDDATA; - for (int j = 0; j < c->nb_heif_item; j++) { + for (j = 0; j < c->nb_heif_item; j++) { item = c->heif_item[j]; if (!item) item = c->heif_item[j] = av_mallocz(sizeof(*item)); @@ -8952,6 +8953,8 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) } if (!item) return AVERROR(ENOMEM); + if (j == c->nb_heif_item) + return AVERROR_INVALIDDATA; item->item_id = item_id; @@ -8975,7 +8978,7 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom) int64_t size = atom.size; uint32_t item_type; int item_id; - int version, ret; + int i, version, ret; version = avio_r8(pb); avio_rb24(pb); // flags. @@ -9010,7 +9013,7 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (size > 0) avio_skip(pb, size); - for (int i = 0; i < c->nb_heif_item; i++) { + for (i = 0; i < c->nb_heif_item; i++) { item = c->heif_item[i]; if (!item) item = c->heif_item[i] = av_mallocz(sizeof(*item)); @@ -9022,6 +9025,8 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom) av_bprint_finalize(&item_name, NULL); return AVERROR(ENOMEM); } + if (i == c->nb_heif_item) + return AVERROR_INVALIDDATA; av_freep(&item->name); av_bprint_finalize(&item_name, ret ? &item->name : NULL); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org