[FFmpeg-cvslog] [ffmpeg] branch master updated. a2cfaf1b91 avformat/mov: pass stream index to sanity_checks on HEIF images

[ffmpeg-git at ffmpeg.org]

The branch, master has been updated
       via  a2cfaf1b916cd4519249031adc37e339baca7a7b (commit)
       via  a28e01a6c16430da689340d0af6eec094020b719 (commit)
      from  7df92712723dee0ace3596684a90282c0e12a8ef (commit)


- Log -----------------------------------------------------------------
commit a2cfaf1b916cd4519249031adc37e339baca7a7b
Author:     James Almer <jamrial at gmail.com>
AuthorDate: Sat Aug 16 21:38:32 2025 -0300
Commit:     James Almer <jamrial at gmail.com>
CommitDate: Sat Aug 16 21:59:18 2025 -0300

    avformat/mov: pass stream index to sanity_checks on HEIF images
    
    Instead of item_id. Same behavior as with standard video tracks.
    
    Signed-off-by: James Almer <jamrial at gmail.com>

diff --git a/libavformat/mov.c b/libavformat/mov.c
index b29c41a6b6..e9a582e5aa 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -10470,7 +10470,7 @@ static int mov_parse_heif_items(AVFormatContext *s)
         sc->sample_size  = sc->stsz_sample_size = item->extent_length;
         sc->sample_count = 1;
 
-        err = sanity_checks(s, sc, item->item_id);
+        err = sanity_checks(s, sc, st->index);
         if (err)
             return AVERROR_INVALIDDATA;
 

commit a28e01a6c16430da689340d0af6eec094020b719
Author:     James Almer <jamrial at gmail.com>
AuthorDate: Sat Aug 16 14:16:38 2025 -0300
Commit:     James Almer <jamrial at gmail.com>
CommitDate: Sat Aug 16 21:59:18 2025 -0300

    avformat/mov: don't use an allocated array for sample_size with HEIF images
    
    The array is only ever needed for streams where each sample entry may have a
    different value. Given that for non animated HEIF there's a single value that
    applies to the image, use the field defined for that.
    
    Fixes: NULL pointer dereference
    Fixes: 437528618/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6537287645331456
    
    Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
    Signed-off-by: James Almer <jamrial at gmail.com>

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 86037c6712..b29c41a6b6 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5456,10 +5456,6 @@ static int heif_add_stream(MOVContext *c, HEIFItem *item)
     if (!sc->chunk_offsets)
         goto fail;
     sc->chunk_count = 1;
-    sc->sample_sizes = av_malloc_array(1, sizeof(*sc->sample_sizes));
-    if (!sc->sample_sizes)
-        goto fail;
-    sc->sample_count = 1;
     sc->stts_data = av_malloc_array(1, sizeof(*sc->stts_data));
     if (!sc->stts_data)
         goto fail;
@@ -10471,11 +10467,13 @@ static int mov_parse_heif_items(AVFormatContext *s)
         st->codecpar->width  = item->width;
         st->codecpar->height = item->height;
 
+        sc->sample_size  = sc->stsz_sample_size = item->extent_length;
+        sc->sample_count = 1;
+
         err = sanity_checks(s, sc, item->item_id);
-        if (err || !sc->sample_count)
+        if (err)
             return AVERROR_INVALIDDATA;
 
-        sc->sample_sizes[0]  = item->extent_length;
         sc->chunk_offsets[0] = item->extent_offset + offset;
 
         if (item->item_id == mov->primary_item_id)

-----------------------------------------------------------------------

Summary of changes:
 libavformat/mov.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)


hooks/post-receive
--