PR #21549 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21549 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21549.patch
Fixes: stack overflow This should have limited security impact as it requires access to arbitrary options. Found-by: Zhenpeng (Leo) Lin from depthfirst Signed-off-by: Michael Niedermayer <[email protected]> >From 83e850020f16fe95556d802dbf981ee8305050e6 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 22 Jan 2026 21:11:34 +0100 Subject: [PATCH] fftools/ffmpeg_opt: limit recursion of presets Fixes: stack overflow This should have limited security impact as it requires access to arbitrary options. Found-by: Zhenpeng (Leo) Lin from depthfirst Signed-off-by: Michael Niedermayer <[email protected]> --- fftools/ffmpeg.h | 2 ++ fftools/ffmpeg_opt.c | 8 ++++++++ 2 files changed, 10 insertions(+) diff --git a/fftools/ffmpeg.h b/fftools/ffmpeg.h index 7720dd9c59..4d109fc015 100644 --- a/fftools/ffmpeg.h +++ b/fftools/ffmpeg.h @@ -258,6 +258,8 @@ typedef struct OptionsContext { SpecifierOptList enc_stats_pre_fmt; SpecifierOptList enc_stats_post_fmt; SpecifierOptList mux_stats_fmt; + + int depth; } OptionsContext; enum IFilterFlags { diff --git a/fftools/ffmpeg_opt.c b/fftools/ffmpeg_opt.c index 80bb9236af..32d6b951f6 100644 --- a/fftools/ffmpeg_opt.c +++ b/fftools/ffmpeg_opt.c @@ -1110,6 +1110,12 @@ static int opt_preset(void *optctx, const char *opt, const char *arg) char filename[1000], line[1000], tmp_line[1000]; const char *codec_name = NULL; int ret = 0; + int depth = o->depth; + + if (depth > 2) { + av_log(NULL, AV_LOG_ERROR, "too deep recursion\n"); + return AVERROR(EINVAL); + } codec_name = opt_match_per_type_str(&o->codec_names, *opt); @@ -1121,6 +1127,7 @@ static int opt_preset(void *optctx, const char *opt, const char *arg) return AVERROR(ENOENT); } + o->depth ++; while (fgets(line, sizeof(line), f)) { char *key = tmp_line, *value, *endptr; @@ -1149,6 +1156,7 @@ static int opt_preset(void *optctx, const char *opt, const char *arg) } fail: + o->depth = depth; fclose(f); return ret; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
