From 711cdae64f572ad2cb2ae879d33ac63f828e6e08 Mon Sep 17 00:00:00 2001 From: Omkhar Arasaratnam Date: Thu, 21 May 2026 00:00:00 +0000 Subject: [PATCH] avformat/mov: cap HEIF ICC profile copies via c*max_streams to bound CPU and memory Found-by: Claude (Anthropic). Human-verified and reported by Omkhar Arasaratnam . Signed-off-by: Omkhar Arasaratnam --- libavformat/isom.h | 1 + libavformat/mov.c | 7 +++++++ 2 files changed, 8 insertions(+) diff --git a/libavformat/isom.h b/libavformat/isom.h index 9b5437fb16..4e7f22b338 100644 --- a/libavformat/isom.h +++ b/libavformat/isom.h @@ -391,6 +391,7 @@ typedef struct MOVContext { int64_t idat_offset; int interleaved_read; AVDictionary* decryption_keys; + unsigned heif_icc_profile_items; } MOVContext; int ff_mp4_read_descr_len(AVIOContext *pb); diff --git a/libavformat/mov.c b/libavformat/mov.c index 8eb67aaadf..436ca415c2 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2146,6 +2146,12 @@ static int mov_read_colr(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR(ENOMEM); icc_profile = sd->data; } else { + if (c->heif_icc_profile_items >= c->fc->max_streams) { + av_log(c->fc, AV_LOG_WARNING, + "HEIF ICC profile copies exceed cap %d; ignoring further items\n", + c->fc->max_streams); + return 0; + } av_freep(&item->icc_profile); icc_profile = item->icc_profile = av_malloc(atom.size - 4); if (!icc_profile) { @@ -2153,6 +2159,7 @@ static int mov_read_colr(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR(ENOMEM); } item->icc_profile_size = atom.size - 4; + c->heif_icc_profile_items++; } ret = ffio_read_size(pb, icc_profile, atom.size - 4); if (ret < 0)