From b39ec3fc308be714a5fabbeeb2ac2fda05bdf5ea Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 5 Sep 2026 23:07:24 +0200 Subject: [PATCH] avformat/mov: Allocate the array without clearing before read Fixes: OOM Fixes: poc-keys-count-16777216-inflated-sizes.mp4 Fixes: hKO4f7GYoUd0 (cherry picked from commit 01c37218510c440416e5322a4c990a021d862957) Signed-off-by: Michael Niedermayer --- libavformat/mov.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 1452c8229f..e7e29d7f92 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -5491,14 +5491,17 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR_INVALIDDATA; } - c->meta_keys_count = count + 1; - c->meta_keys = av_mallocz(c->meta_keys_count * sizeof(*c->meta_keys)); + c->meta_keys = av_malloc_array(count + 1, sizeof(*c->meta_keys)); if (!c->meta_keys) return AVERROR(ENOMEM); + c->meta_keys[0] = NULL; + c->meta_keys_count = 1; for (i = 1; i <= count; ++i) { uint32_t key_size = avio_rb32(pb); uint32_t type = avio_rl32(pb); + c->meta_keys[i] = NULL; + c->meta_keys_count = i + 1; if (key_size < 8 || key_size > atom.size) { av_log(c->fc, AV_LOG_ERROR, "The key# %"PRIu32" in meta has invalid size:"