This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 983dae9c19 avformat/rtpenc_av1: bound OBU size in the keyframe search
loop
983dae9c19 is described below
commit 983dae9c19f46c87d597598c0fd2f2fcee0ad2f8
Author: Joshua Rogers <[email protected]>
AuthorDate: Tue Aug 4 12:11:55 2026 +0000
Commit: michaelni <[email protected]>
CommitDate: Tue Aug 11 23:34:09 2026 +0000
avformat/rtpenc_av1: bound OBU size in the keyframe search loop
The is_keyframe sequence-header search loop advanced buf_ptr/rem_size by
num_lebs + obu_size without bounding obu_size against the remaining data
(unlike the main packetization loop). A crafted obu_size (~0x80000010)
wraps the signed rem_size back positive, so the next iteration
dereferences a pointer past the packet. Consume the LEB bytes first, then
reject an OBU larger than the remaining size. Out-of-bounds read reachable
from a crafted AV1 packet muxed to RTP.
Fixes: out of array read
---
libavformat/rtpenc_av1.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/libavformat/rtpenc_av1.c b/libavformat/rtpenc_av1.c
index fbf9212216..ae66fdb86f 100644
--- a/libavformat/rtpenc_av1.c
+++ b/libavformat/rtpenc_av1.c
@@ -116,8 +116,15 @@ void ff_rtp_send_av1(AVFormatContext *ctx, const uint8_t
*frame_buf, int frame_s
if (!num_lebs) {
break;
}
- buf_ptr += num_lebs + obu_size;
- rem_size -= num_lebs + obu_size;
+ buf_ptr += num_lebs;
+ rem_size -= num_lebs;
+ // bound OBU payload against remaining data to avoid pointer/size
+ // wraparound (mirrors the check in the packetization loop below)
+ if (obu_size > (uint32_t) rem_size) {
+ break;
+ }
+ buf_ptr += obu_size;
+ rem_size -= obu_size;
}
#else // RTPENC_AV1_SEARCH_SEQ_HEADER
av_log(ctx, AV_LOG_DEBUG, "Marking FIRST packet\n");
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
