[FFmpeg-cvslog] [ffmpeg] fftools/ffmpeg_opt: limit recursion of presets (branch master)

[Michael Niedermayer via ffmpeg-cvslog]

This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch master
in repository ffmpeg.

The following commit(s) were added to refs/heads/master by this push:
     new 0833dd3665 fftools/ffmpeg_opt: limit recursion of presets
0833dd3665 is described below

commit 0833dd3665baede81ae700ae7e04a7c5143984af
Author:     Michael Niedermayer <mich...@niedermayer.cc>
AuthorDate: Thu Jan 22 21:11:34 2026 +0100
Commit:     michaelni <mich...@niedermayer.cc>
CommitDate: Tue Feb 17 13:41:37 2026 +0000

    fftools/ffmpeg_opt: limit recursion of presets
    
    Fixes: stack overflow
    
    This should have limited security impact as it requires access to arbitrary
    options.
    
    Found-by: Zhenpeng (Leo) Lin from depthfirst
    Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
 fftools/ffmpeg.h     | 2 ++
 fftools/ffmpeg_opt.c | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/fftools/ffmpeg.h b/fftools/ffmpeg.h
index 3e66534d48..b4d3a2c2ac 100644
--- a/fftools/ffmpeg.h
+++ b/fftools/ffmpeg.h
@@ -258,6 +258,8 @@ typedef struct OptionsContext {
     SpecifierOptList enc_stats_pre_fmt;
     SpecifierOptList enc_stats_post_fmt;
     SpecifierOptList mux_stats_fmt;
+
+    int depth;
 } OptionsContext;
 
 enum IFilterFlags {
diff --git a/fftools/ffmpeg_opt.c b/fftools/ffmpeg_opt.c
index 80bb9236af..a0664e2964 100644
--- a/fftools/ffmpeg_opt.c
+++ b/fftools/ffmpeg_opt.c
@@ -1110,6 +1110,12 @@ static int opt_preset(void *optctx, const char *opt, 
const char *arg)
     char filename[1000], line[1000], tmp_line[1000];
     const char *codec_name = NULL;
     int ret = 0;
+    int depth = o->depth;
+
+    if (depth > 2) {
+        av_log(NULL, AV_LOG_ERROR, "too deep recursion\n");
+        return AVERROR(EINVAL);
+    }
 
     codec_name = opt_match_per_type_str(&o->codec_names, *opt);
 
@@ -1121,6 +1127,7 @@ static int opt_preset(void *optctx, const char *opt, 
const char *arg)
         return AVERROR(ENOENT);
     }
 
+    o->depth ++;
     while (fgets(line, sizeof(line), f)) {
         char *key = tmp_line, *value, *endptr;
 
@@ -1149,6 +1156,7 @@ static int opt_preset(void *optctx, const char *opt, 
const char *arg)
     }
 
 fail:
+    o->depth = depth;
     fclose(f);
 
     return ret;

_______________________________________________
ffmpeg-cvslog mailing list -- ffmpeg-cvslog@ffmpeg.org
To unsubscribe send an email to ffmpeg-cvslog-le...@ffmpeg.org