From a7d42bfba8bbdfd028f930ca24fc7afc8150bef4 Mon Sep 17 00:00:00 2001 From: Dale Curtis Date: Wed, 22 Apr 2026 20:19:02 +0000 Subject: [PATCH] avformat/mov: Limit maximum box size for mov_read_lhvc() Signed-off-by: Dale Curtis --- libavformat/mov.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 12fb00be59..ff687fb18c 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8683,8 +8683,10 @@ static int mov_read_lhvc(MOVContext *c, AVIOContext *pb, MOVAtom atom) // TODO: handle lhvC when present before hvcC return 0; - if (atom.size < 6 || st->codecpar->extradata_size < 23) + if (atom.size < 6 || st->codecpar->extradata_size < 23 || + atom.size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) { return AVERROR_INVALIDDATA; + } buf = av_malloc(atom.size + AV_INPUT_BUFFER_PADDING_SIZE); if (!buf)