From 33ae6cda71e6d34c9081a612abae00e2c7d39f72 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 28 Jul 2025 15:34:27 +0200 Subject: [PATCH] avformat/dhav: fix reference point mixup Fixes: reading the duration from before the start of the allocated buffer. Regression since: 36ec9217e6dca3432304c9d76078d9618247eb0f Fixes: BIGSLEEP-433513232/test Found-by: Google Big Sleep Signed-off-by: Michael Niedermayer --- libavformat/dhav.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/dhav.c b/libavformat/dhav.c index 9bdb23322d..70626c2f2e 100644 --- a/libavformat/dhav.c +++ b/libavformat/dhav.c @@ -279,7 +279,7 @@ static int64_t get_duration(AVFormatContext *s) } } - if (end_pos < 0 || end_pos + 16 > end_buffer_pos + end_buffer_size) + if (end_pos < end_buffer_pos || end_pos + 16 > end_buffer_pos + end_buffer_size) goto fail; date = AV_RL32(end_buffer + (end_pos - end_buffer_pos) + 16);