This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit dc57051f46ef93e2d743f66e460198d5e1ca1f53 Author: Michael Niedermayer <[email protected]> AuthorDate: Wed Aug 12 01:34:52 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Wed Aug 12 04:52:01 2026 +0200 avformat/mpegts: reject a max_packet_size below one TS payload Fixes: ffmpeg -max_packet_size 100 -i fate-suite/mpegts/h264small.ts -f null - Fixes: out of array access Fixes: eYvYXUJZbPJ Regression since: bca30570d28bbaa07badadabf55ec3589201a82f Found-by: Eunsoo Kim, Microsoft FORGE Labs (cherry picked from commit 37721094ab4bac1215168b5b8a7defa1bc2d6581) Signed-off-by: Michael Niedermayer <[email protected]> --- doc/demuxers.texi | 2 +- libavformat/mpegts.c | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/doc/demuxers.texi b/doc/demuxers.texi index a1dd879b59..8603069949 100644 --- a/doc/demuxers.texi +++ b/doc/demuxers.texi @@ -1008,7 +1008,7 @@ streams move to different PIDs. Default value is 0. @item max_packet_size Set maximum size, in bytes, of packet emitted by the demuxer. Payloads above this size -are split across multiple packets. Range is 1 to INT_MAX/2. Default is 204800 bytes. +are split across multiple packets. Range is 184 to INT_MAX/2. Default is 204800 bytes. @end table @section mpjpeg diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 101011e520..cde8f46c5b 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -52,6 +52,9 @@ * synchronization is lost */ #define MAX_RESYNC_SIZE 65536 +/* payload of a TS packet which carries no adaptation field */ +#define TS_PAYLOAD_SIZE (TS_PACKET_SIZE - 4) + #define MAX_MP4_DESCR_COUNT 16 #define MOD_UNLIKELY(modulus, dividend, divisor, prev_dividend) \ @@ -223,7 +226,7 @@ static const AVOption options[] = { {"skip_clear", "skip clearing programs", offsetof(MpegTSContext, skip_clear), AV_OPT_TYPE_BOOL, {.i64 = 0}, 0, 1, 0 }, {"max_packet_size", "maximum size of emitted packet", offsetof(MpegTSContext, max_packet_size), AV_OPT_TYPE_INT, - {.i64 = 204800}, 1, INT_MAX/2, AV_OPT_FLAG_DECODING_PARAM }, + {.i64 = 204800}, TS_PAYLOAD_SIZE, INT_MAX/2, AV_OPT_FLAG_DECODING_PARAM }, { NULL }, }; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
