Commit 332df18e67 for ffmpeg

commit 332df18e67c0f689d4dd5d0b2154e612cd871b3e
Author: Martin Mirchev <mmirchev@comp.nus.edu.sg>
Date:   Tue Oct 27 10:45:34 2026 +0800

    avformat/mov: reject tfra boxes smaller than their header

    mov_read_mfra() calls read_tfra() until it returns non-zero, and
    read_tfra() ends by seeking to the box start plus its declared size.
    A tfra box with size 0 therefore seeks back onto itself and is parsed
    again forever. Since the whole box stays in the AVIOContext buffer, no
    read reaches the protocol layer and the interrupt callback is never
    checked, so the demuxer cannot be interrupted either.

    The mfra is read on the first moof when use_mfra_for is enabled, which
    an "Anevia" free box does by default, so a 76-byte file can make
    avformat_open_input() spin indefinitely.

    Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>

diff --git a/libavformat/mov.c b/libavformat/mov.c
index e2f33643f7..83bf9fa8d4 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -11013,6 +11013,12 @@ static int read_tfra(MOVContext *mov, AVIOContext *f)
     if (avio_rb32(f) != MKBETAG('t', 'f', 'r', 'a')) {
         return 1;
     }
+    /* A tfra box can not be smaller than its 24-byte header. A size of 0
+     * would make mov_read_mfra() re-read the same box forever. */
+    if (size < 24) {
+        av_log(mov->fc, AV_LOG_ERROR, "Invalid tfra size %"PRIu32"\n", size);
+        return AVERROR_INVALIDDATA;
+    }
     av_log(mov->fc, AV_LOG_VERBOSE, "found tfra\n");

     version = avio_r8(f);