From 01c828bac16f85e42753bd597db8245978b3a3ac Mon Sep 17 00:00:00 2001 From: David Korczynski Date: Wed, 20 May 2026 15:15:01 -0700 Subject: [PATCH] avformat/dhav: Fix second integer overflow in get_duration() Fixes: ada-2-poc.dhav Found-by: Claude and Ada Logics. This issue was found by Anthropic from using agents to study security of open source projects, and I am from Ada Logics helping validate the found issues and report to maintainers. (cherry picked from commit 50e65074f5cca638d6dd4cf9db4b6dcf4f0a863e) Signed-off-by: Michael Niedermayer --- libavformat/dhav.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/dhav.c b/libavformat/dhav.c index e5eef290b8..e6279ea31a 100644 --- a/libavformat/dhav.c +++ b/libavformat/dhav.c @@ -279,7 +279,7 @@ static int64_t get_duration(AVFormatContext *s) } } - if (pos < buffer_pos || pos + 20 > buffer_pos + buffer_size) + if (pos < buffer_pos || pos - buffer_pos > buffer_size - 20) goto fail; date = AV_RL32(buffer + (pos - buffer_pos) + 16);