This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/4.4 in repository ffmpeg.
commit b9c777ac2d7b0c05ef5694ace59d0a50bc4fdf24 Author: Michael Niedermayer <[email protected]> AuthorDate: Fri Jan 23 15:28:58 2026 +0100 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue May 5 18:55:00 2026 +0200 avformat/mpegtsenc: Check remaining space in SDT Fixes: out of array access Fixes: VULN-8 Found-by: Zhenpeng (Leo) Lin from depthfirst Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 19c78cd6d90f025657348c28e9562e4e1bda3802) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mpegtsenc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavformat/mpegtsenc.c b/libavformat/mpegtsenc.c index 35c835c484..d865b00994 100644 --- a/libavformat/mpegtsenc.c +++ b/libavformat/mpegtsenc.c @@ -50,6 +50,7 @@ typedef struct MpegTSSection { int discontinuity; void (*write_packet)(struct MpegTSSection *s, const uint8_t *packet); void *opaque; + int remaining; } MpegTSSection; typedef struct MpegTSService { @@ -889,6 +890,10 @@ static MpegTSService *mpegts_add_service(AVFormatContext *s, int sid, av_log(s, AV_LOG_ERROR, "Too long service or provider name\n"); goto fail; } + ts->sdt.remaining -= 10 + service->provider_name[0] + service->name[0]; + if (ts->sdt.remaining < 0) + goto fail; + if (av_dynarray_add_nofree(&ts->services, &ts->nb_services, service) < 0) goto fail; @@ -997,6 +1002,8 @@ static int mpegts_init(AVFormatContext *s) // round up to a whole number of TS packets ts->pes_payload_size = (ts->pes_payload_size + 14 + 183) / 184 * 184 - 14; + ts->sdt.remaining = SECTION_LENGTH - 3; + if (!s->nb_programs) { /* allocate a single DVB service */ if (!mpegts_add_service(s, ts->service_id, s->metadata, NULL)) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
