Commit 1ed0bf80ad for ffmpeg
commit 1ed0bf80ad485ec7f4baaca0c293f6a6e9ab9db7
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat Oct 10 06:48:07 2026 +0200
avformat/mov: keep the duration of edits with a negative media time
The overflow check of the rescaled edit duration added the media time as
an unsigned value, so a negative media time wrapped the sum and the
duration of any edit starting more than its duration before composition
time 0 was zeroed, dropping the edit. The media time of an edit is a
composition time (ISO/IEC 14496-12 8.6.6.3) and composition times are
negative when signed composition offsets place the first frames before
zero (8.6.1.3), with the smallest one recommended to match the start of
the first edit (8.6.1.4).
Found during triage/review of OSS-Fuzz issue 476170159
Fixes: dDfkF1EeYsUC
Regression since: 2882d30e3acfc3155e2be11db653c7c721f94f34
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
diff --git a/libavformat/mov.c b/libavformat/mov.c
index cb75544aa4..c710e21bdd 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4205,7 +4205,7 @@ static int get_edit_list_entry(MOVContext *mov,
global_timescale);
if (*edit_list_duration < 0 ||
- *edit_list_duration + (uint64_t)*edit_list_media_time > INT64_MAX)
+ *edit_list_media_time > INT64_MAX - *edit_list_duration)
*edit_list_duration = 0;
return 1;