dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-10 17:14:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

avformat/ty: don't let the Series2 AC3 trim underflow the packet size

Browse Source 
Fixes: negative-size-param
Fixes: ty-s2-ac3-negative-size-single-file.ffconcat / create_poc.py
Fixes: g0qeE6KvrjZi
Found-by: Adrian Junge (vurlo)
This commit is contained in:
Michael Niedermayer
2026-07-10 04:07:35 +02:00
committed by michaelni
parent a7e38b617b
commit de771bd527
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/ty.c
View File

@@ -578,7 +578,7 @@ static int demux_audio(AVFormatContext *s, TyRecHdr *rec_hdr, AVPacket *pkt)
if (ty->audio_type == TIVO_AUDIO_AC3 &&
ty->tivo_series == TIVO_SERIES2) {
if (ty->ac3_pkt_size + pkt->size > AC3_PKT_LENGTH) {
pkt->size -= 2;
pkt->size -= FFMIN(pkt->size, 2);
ty->ac3_pkt_size = 0;
} else {
ty->ac3_pkt_size += pkt->size;