From 0ba284bbcbbefecfd110859acce36cbc8a4bdf82 Mon Sep 17 00:00:00 2001 From: Marvin Scholz Date: Tue, 29 Sep 2026 13:00:40 +0000 Subject: [PATCH] avformat/matroskadec: prevent duration float-cast-overflow Reset matroska->duration to 0 if it is negative or if matroska->duration * matroska->time_scale would exceed INT64_MAX, preventing a float-cast-overflow when calculating the duration. Signed-off-by: Marvin Scholz (cherry picked from commit d42f8d8767cb0d11fdbd5bf7c3dc2e426f97b3ca) --- libavformat/matroskadec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index 18849af689..b074354116 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -3490,7 +3490,8 @@ static int matroska_read_header(AVFormatContext *s) if (!matroska->time_scale) matroska->time_scale = 1000000; - if (isnan(matroska->duration)) + if (isnan(matroska->duration) || matroska->duration < 0 || + matroska->duration >= (double)INT64_MAX / matroska->time_scale) matroska->duration = 0; if (matroska->duration) matroska->ctx->duration = matroska->duration * matroska->time_scale *