Builder ffmpegsos-solaris10-i386 Build #13942

Results:

Failed shell_2 shell_3 shell_4 shell_5

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-ffmpegsos-solaris10-i386' triggered this build

Steps and Logfiles:

1. git update ( 4 secs )
   1. stdio
2. shell 'gsed -i ...' ( 0 secs )
   1. stdio
3. shell_1 'gsed -i ...' ( 0 secs )
   1. stdio
4. shell_2 'gsed -i ...' failed ( 0 secs )
   1. stdio
5. shell_3 './configure --samples="../../../ffmpeg/fate-suite" ...' failed ( 8 secs )
   1. stdio
   2. config.log
6. shell_4 'gmake fate-rsync' failed ( 2 secs )
   1. stdio
7. shell_5 '../../../ffmpeg/fate.sh ../../../ffmpeg/fate_config_sos.sh' failed ( 2 secs )
   1. stdio
   2. configure.log
   3. compile.log
   4. test.log

Build Properties:

Forced Build Properties:

Responsible Users:

1. Omkhar Arasaratnam

   omkharohnoyoudont@linkedin.com

Timing:

All Changes:

:

1. Change #268290

   Category	ffmpeg
   Changed by	Omkhar Arasaratnam <omkharohnoyoudont@linkedin.com>
   Changed at	Mon 25 May 2026 23:53:01
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	387ad6d1029c6c75a62cf3ed2d2526f8d8329354

   Comments

   avformat/mov: validate APV access unit length before passing to decoder
   libavformat/mov.c read the APV AU length field directly from the
   sample without sanity-checking against the remaining sample size or
   a documented maximum. The patch validates that au_size is bounded by
   the remaining sample bytes and that the AU envelope (4 bytes plus
   au_size) fits inside the declared sample size.
   
   Validate the access unit length at the demuxer boundary so that the
   decoder is not handed an attacker-controllable buffer size. Returns
   AVERROR_INVALIDDATA on the bound failure with an explicit log line.
   
   Found-by: Claude (Anthropic). Human-verified and reported by
   Omkhar Arasaratnam <omkhar@linkedin.com>.
   Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>

   Changed files

   • libavformat/mov.c