This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit f175bd50821f9adcded3acacc6b8e04037a92715 Author: Joshua Rogers <[email protected]> AuthorDate: Tue Aug 4 12:11:55 2026 +0000 Commit: Michael Niedermayer <[email protected]> CommitDate: Wed Aug 12 04:52:00 2026 +0200 avformat/rtpenc_av1: bound OBU size in the keyframe search loop The is_keyframe sequence-header search loop advanced buf_ptr/rem_size by num_lebs + obu_size without bounding obu_size against the remaining data (unlike the main packetization loop). A crafted obu_size (~0x80000010) wraps the signed rem_size back positive, so the next iteration dereferences a pointer past the packet. Consume the LEB bytes first, then reject an OBU larger than the remaining size. Out-of-bounds read reachable from a crafted AV1 packet muxed to RTP. Fixes: out of array read (cherry picked from commit 983dae9c19f46c87d597598c0fd2f2fcee0ad2f8) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/rtpenc_av1.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/libavformat/rtpenc_av1.c b/libavformat/rtpenc_av1.c index fbf9212216..ae66fdb86f 100644 --- a/libavformat/rtpenc_av1.c +++ b/libavformat/rtpenc_av1.c @@ -116,8 +116,15 @@ void ff_rtp_send_av1(AVFormatContext *ctx, const uint8_t *frame_buf, int frame_s if (!num_lebs) { break; } - buf_ptr += num_lebs + obu_size; - rem_size -= num_lebs + obu_size; + buf_ptr += num_lebs; + rem_size -= num_lebs; + // bound OBU payload against remaining data to avoid pointer/size + // wraparound (mirrors the check in the packetization loop below) + if (obu_size > (uint32_t) rem_size) { + break; + } + buf_ptr += obu_size; + rem_size -= obu_size; } #else // RTPENC_AV1_SEARCH_SEQ_HEADER av_log(ctx, AV_LOG_DEBUG, "Marking FIRST packet\n"); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
