This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit d7e89879b693f1576cd271fe88b9a0439cc44d79 Author: Michael Niedermayer <[email protected]> AuthorDate: Wed Aug 12 01:34:26 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Wed Aug 12 04:52:01 2026 +0200 avformat/mpegts: keep the PES payload within max_packet_size Fixes: out of array access Fixes: eYvYXUJZbPJ Regression since: bca30570d28bbaa07badadabf55ec3589201a82f Found-by: Eunsoo Kim, Microsoft FORGE Labs (cherry picked from commit c42ac5c5668fef93f84960a1d8bf0605bdd812ea) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mpegts.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 076020509d..101011e520 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -1460,8 +1460,14 @@ skip: case MPEGTS_PAYLOAD: do { int max_packet_size = ts->max_packet_size; - if (pes->PES_packet_length && pes->PES_packet_length + PES_START_SIZE > pes->pes_header_size) - max_packet_size = pes->PES_packet_length + PES_START_SIZE - pes->pes_header_size; + if (pes->PES_packet_length && pes->PES_packet_length + PES_START_SIZE > pes->pes_header_size) { + const int pes_payload_size = pes->PES_packet_length + PES_START_SIZE - pes->pes_header_size; + + if (pes_payload_size > ts->max_packet_size) + pes->PES_packet_length = 0; + else + max_packet_size = pes_payload_size; + } if (pes->data_index > 0 && pes->data_index + buf_size > max_packet_size) { _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
