This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 0c058a08554af2ae962497e7453c9595bc12f998 Author: Joshua Rogers <[email protected]> AuthorDate: Tue Oct 6 23:03:34 2026 +0200 Commit: michaelni <[email protected]> CommitDate: Thu Oct 15 00:58:38 2026 +0000 avformat/rtpenc_mpv: Do not read a picture header past the end of the packet A packet ending in a picture start code made the temporal reference and picture type be read from after the end of the packet. This is not a security issue, the bytes read are in the padding that muxer input is required to have, see ce1f4c78d1. Fixes: read into padding Fixes: FbXPpSfFS7Zp Fixes: AISLE-2026-0111-00268 Read past the packet end Replicated through API with ASAN, using an unpadded packet Wrong picture header Replicated through UnModified FFmpeg with the sample of trac ticket 6345 Found-by: Joshua Rogers <[email protected]> --- libavformat/rtpenc_mpv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtpenc_mpv.c b/libavformat/rtpenc_mpv.c index c18c75082f..c371c41ce1 100644 --- a/libavformat/rtpenc_mpv.c +++ b/libavformat/rtpenc_mpv.c @@ -59,7 +59,7 @@ void ff_rtp_send_mpegvideo(AVFormatContext *s1, const uint8_t *buf1, int size) r = avpriv_find_start_code(r1, end, &start_code); if((start_code & 0xFFFFFF00) == 0x100) { /* New start code found */ - if (start_code == 0x100) { + if (start_code == 0x100 && end - r >= 2) { frame_type = (r[1] & 0x38) >> 3; temporal_reference = (int)r[0] << 2 | r[1] >> 6; } -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
