[PR] avformat/mov: bound sgpd sync entry_count by the atom size (PR #23901)

PR #23901 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23901
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23901.patch

Fixes: unbounded allocation
Fixes: ffmpeg-sgpd-sync-entry-count-alloc.mp4
Fixes: 4f7OaHqbUKh2
Found-by: Brian Lee, Youngjoon Kim (Georgia Tech SSLab)



>From 79e605b36e917d2331567287cc499c01a747d8b7 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Wed, 22 Jul 2026 06:17:01 +0200
Subject: [PATCH] avformat/mov: bound sgpd sync entry_count by the atom size

Fixes: unbounded allocation
Fixes: ffmpeg-sgpd-sync-entry-count-alloc.mp4
Fixes: 4f7OaHqbUKh2
Found-by: Brian Lee, Youngjoon Kim (Georgia Tech SSLab)
---
 libavformat/mov.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index dc425e4e9f..70acb8b2b1 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4007,6 +4007,9 @@ static int mov_read_sgpd(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     default_group_description_index = version >= 2 ? avio_rb32(pb) : 0;
     entry_count = avio_rb32(pb);
 
+    if (entry_count > atom.size)
+        return AVERROR_INVALIDDATA;
+
     av_freep(&sc->sgpd_sync);
     sc->sgpd_sync_count = entry_count;
     sc->sgpd_sync = av_calloc(entry_count, sizeof(*sc->sgpd_sync));
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]