From 4ccad70d5797f13de4f6c249065e83d4130da268 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 5 Mar 2026 16:38:03 +0100
Subject: [PATCH] avformat/hxvs: Do not allow backward steps in hxvs_probe()

Fixes: infinite loop
Fixes: 487632033/clusterfuzz-testcase-minimized-ffmpeg_dem_IMAGE2_fuzzer-4565877872984064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/hxvs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavformat/hxvs.c b/libavformat/hxvs.c
index ed827c8d97..998faed803 100644
--- a/libavformat/hxvs.c
+++ b/libavformat/hxvs.c
@@ -118,6 +118,10 @@ static int hxvs_probe(const AVProbeData *p)
         i += 4;
         if (tag == HXVF || tag == HXAF) {
             bytes = AV_RL32(&p->buf[i]);
+
+            if (12 + bytes > INT_MAX - i)
+                return 0;
+
             i += 12 + bytes;
             flag |= (tag == HXVF) ? 2 : 4;
             continue;