Commit c705686a33 for ffmpeg

commit c705686a33f0f195f1190392a68b3342f847944a
Author: Marvin Scholz <epirat07@gmail.com>
Date:   Thu Oct 1 16:34:37 2026 +0000

    avformat/mov: prevent float-cast-overflow in mov_read_clap

    horiz_off.num and vert_off.num are signed integers and may be
    negative, which can make the calculated top, bottom, left, or right crop
    coordinates negative before bounds checking. Casting a negative double
    to uint64_t is undefined behavior. Additionally, zero denominators for
    the rational values were not rejected.

    Use int64_t for top, bottom, left, and right, reject zero denominators,
    and check for negative coordinates.

    Signed-off-by: Marvin Scholz <epirat07@gmail.com>

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 4870070cbf..a89747666b 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1379,7 +1379,7 @@ static int mov_read_clap(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     int width, height, err = 0;
     AVRational aperture_width, aperture_height, horiz_off, vert_off;
     AVRational pc_x, pc_y;
-    uint64_t top, bottom, left, right;
+    int64_t top, bottom, left, right;

     item = get_heif_item(c, c->cur_item_id);
     st = get_curr_st(c);
@@ -1407,9 +1407,9 @@ static int mov_read_clap(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     vert_off.num  = avio_rb32(pb);
     vert_off.den  = avio_rb32(pb);

-    if (aperture_width.num  < 0 || aperture_width.den  < 0 ||
-        aperture_height.num < 0 || aperture_height.den < 0 ||
-        horiz_off.den       < 0 || vert_off.den        < 0) {
+    if (aperture_width.num  < 0 || aperture_width.den  <= 0 ||
+        aperture_height.num < 0 || aperture_height.den <= 0 ||
+        horiz_off.den      <= 0 || vert_off.den        <= 0) {
         err = AVERROR_INVALIDDATA;
         goto fail;
     }
@@ -1438,8 +1438,8 @@ static int mov_read_clap(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     top    = av_q2d(av_sub_q(pc_y, aperture_height));
     bottom = av_q2d(av_add_q(pc_y, aperture_height));

-    if (bottom > (height - 1) ||
-        right  > (width  - 1)) {
+    if (top  < 0 || bottom < 0 || bottom > (height - 1) ||
+        left < 0 || right  < 0 || right  > (width  - 1)) {
         err = AVERROR_INVALIDDATA;
         goto fail;
     }