[PR] avformat/mov: clamp trun sample count to what the input can hold (PR #23750)

PR #23750 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23750
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23750.patch

the code later treated EOF non fatally and just continues with a
truncated list, this mirrors this

Fixes: OOM
Fixes: 525088811/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5229499332231168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg



>From 6efafb6833f9b98aab3b679faa4148960cdeec66 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Tue, 7 Jul 2026 23:41:53 +0200
Subject: [PATCH] avformat/mov: clamp trun sample count to what the input can
 hold

the code later treated EOF non fatally and just continues with a
truncated list, this mirrors this

Fixes: OOM
Fixes: 525088811/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5229499332231168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
---
 libavformat/mov.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 4154038d9e..7e6b905ff5 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -6002,6 +6002,19 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     entries = avio_rb32(pb);
     av_log(c->fc, AV_LOG_TRACE, "flags 0x%x entries %u\n", flags, entries);
 
+    int entry_size = !!(flags & MOV_TRUN_SAMPLE_DURATION) * 4
+                    + !!(flags & MOV_TRUN_SAMPLE_SIZE)     * 4
+                    + !!(flags & MOV_TRUN_SAMPLE_FLAGS)    * 4
+                    + !!(flags & MOV_TRUN_SAMPLE_CTS)      * 4;
+    int64_t size = avio_size(pb);
+    int64_t pos  = avio_tell(pb);
+    if (size >= 0 && pos >= 0 && pos <= size) {
+        uint64_t max_entries = entry_size ? (uint64_t)(size - pos) / entry_size
+                                            : (uint64_t)size;
+        if (entries > max_entries)
+            entries = max_entries;
+    }
+
     if ((uint64_t)entries+sc->tts_count >= UINT_MAX/sizeof(*sc->tts_data))
         return AVERROR_INVALIDDATA;
     if (flags & MOV_TRUN_DATA_OFFSET)        data_offset        = avio_rb32(pb);
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]