[PR] avformat/hevc: reject hvcC NAL arrays that overflow the 16-bit count (PR #24088)

PR #24088 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088.patch

numNalus is uint16_t; a crafted hvcC declaring >65535 NAL units of one
type wraps it to 0 and then writes nal[-1]. Reject before the count can
wrap. Reachable by remuxing a crafted file with -c copy.

Fixes: integer overflow
Fixes: out of array access



>From 75d0c5f81a021500017a795b97bdf9cd24b19bce Mon Sep 17 00:00:00 2001
From: Joshua Rogers <[email protected]>
Date: Tue, 4 Aug 2026 12:11:56 +0000
Subject: [PATCH] avformat/hevc: reject hvcC NAL arrays that overflow the
 16-bit count

numNalus is uint16_t; a crafted hvcC declaring >65535 NAL units of one
type wraps it to 0 and then writes nal[-1]. Reject before the count can
wrap. Reachable by remuxing a crafted file with -c copy.

Fixes: integer overflow
Fixes: out of array access
---
 libavformat/hevc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/hevc.c b/libavformat/hevc.c
index c9ee11f36c..678a9e2206 100644
--- a/libavformat/hevc.c
+++ b/libavformat/hevc.c
@@ -844,6 +844,9 @@ static int hvcc_array_add_nal_unit(const uint8_t *nal_buf, uint32_t nal_size,
     int ret;
     uint16_t numNalus = array->numNalus;
 
+    if (numNalus >= UINT16_MAX)
+        return AVERROR_INVALIDDATA;
+
     ret = av_reallocp_array(&array->nal, numNalus + 1, sizeof(*array->nal));
     if (ret < 0)
         return ret;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]