From bfe2e65e6b963aa4a37d97b4bfec1599d34a1535 Mon Sep 17 00:00:00 2001
From: tabudz <openhands@all-hands.dev>
Date: Sun, 8 Mar 2026 00:26:55 +0800
Subject: [PATCH] avformat/nsvdec: Fix DoS due to lack of eof check in
 nsvs_file_offset loop.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes: 20170829.nsv

Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com>
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 3rdparty/ffmpeg/libavformat/nsvdec.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/3rdparty/ffmpeg/libavformat/nsvdec.c b/3rdparty/ffmpeg/libavformat/nsvdec.c
index 95fab644..b8353a7b 100644
--- a/3rdparty/ffmpeg/libavformat/nsvdec.c
+++ b/3rdparty/ffmpeg/libavformat/nsvdec.c
@@ -350,9 +350,12 @@ static int nsv_parse_NSVf_header(AVFormatContext *s)
         if (!nsv->nsvs_file_offset)
             return AVERROR(ENOMEM);
 
-        for(i=0;i<table_entries_used;i++)
+        for(i=0;i<table_entries_used;i++) {
+            if (avio_feof(pb))
+                return AVERROR_INVALIDDATA;
             nsv->nsvs_file_offset[i] = avio_rl32(pb) + size;
-
+        }
+        
         if(table_entries > table_entries_used &&
            avio_rl32(pb) == MKTAG('T','O','C','2')) {
             nsv->nsvs_timestamps = av_malloc_array((unsigned)table_entries_used, sizeof(uint32_t));