PR #22477 opened by Zhao Zhili (quink) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22477 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22477.patch
Since commit 49c6e6cc44f, ff_parse_opts_from_query_string validates option values against their declared ranges. The listen_timeout and timeout options had their minimum set to -1, but callers may pass arbitrary negative values as sentinels. Relax the minimum to INT_MIN for both options to avoid spurious range check failures. rtmpproto passes listen_timeout to tcp as milliseconds by multiplying by 1000. However, negative listen_timeout values are special sentinels (e.g. -1 means infinite wait), and should not be multiplied. Both commit can fix #22469. >From a3f593afd763c0cce6dc4d403c96a3e1f0603984 Mon Sep 17 00:00:00 2001 From: Zhao Zhili <[email protected]> Date: Wed, 11 Mar 2026 21:48:27 +0800 Subject: [PATCH 1/2] avformat/tcp: relax listen_timeout and timeout option range Since commit 49c6e6cc44f, ff_parse_opts_from_query_string validates option values against their declared ranges. The listen_timeout and timeout options had their minimum set to -1, but callers may pass arbitrary negative values as sentinels. Relax the minimum to INT_MIN for both options to avoid spurious range check failures. Fixes ticket #22469. Signed-off-by: Zhao Zhili <[email protected]> --- libavformat/tcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/tcp.c b/libavformat/tcp.c index 09dc8a9679..c60290206c 100644 --- a/libavformat/tcp.c +++ b/libavformat/tcp.c @@ -58,8 +58,8 @@ static const AVOption options[] = { { "listen", "Listen for incoming connections", OFFSET(listen), AV_OPT_TYPE_INT, { .i64 = 0 }, 0, 2, .flags = D|E }, { "local_port", "Local port", OFFSET(local_port), AV_OPT_TYPE_STRING, { .str = NULL }, 0, 0, .flags = D|E }, { "local_addr", "Local address", OFFSET(local_addr), AV_OPT_TYPE_STRING, { .str = NULL }, 0, 0, .flags = D|E }, - { "timeout", "set timeout (in microseconds) of socket I/O operations", OFFSET(rw_timeout), AV_OPT_TYPE_INT, { .i64 = -1 }, -1, INT_MAX, .flags = D|E }, - { "listen_timeout", "Connection awaiting timeout (in milliseconds)", OFFSET(listen_timeout), AV_OPT_TYPE_INT, { .i64 = -1 }, -1, INT_MAX, .flags = D|E }, + { "timeout", "set timeout (in microseconds) of socket I/O operations", OFFSET(rw_timeout), AV_OPT_TYPE_INT, { .i64 = -1 }, INT_MIN, INT_MAX, .flags = D|E }, + { "listen_timeout", "Connection awaiting timeout (in milliseconds)", OFFSET(listen_timeout), AV_OPT_TYPE_INT, { .i64 = -1 }, INT_MIN, INT_MAX, .flags = D|E }, { "send_buffer_size", "Socket send buffer size (in bytes)", OFFSET(send_buffer_size), AV_OPT_TYPE_INT, { .i64 = -1 }, -1, INT_MAX, .flags = D|E }, { "recv_buffer_size", "Socket receive buffer size (in bytes)", OFFSET(recv_buffer_size), AV_OPT_TYPE_INT, { .i64 = -1 }, -1, INT_MAX, .flags = D|E }, { "tcp_nodelay", "Use TCP_NODELAY to disable nagle's algorithm", OFFSET(tcp_nodelay), AV_OPT_TYPE_BOOL, { .i64 = 0 }, 0, 1, .flags = D|E }, -- 2.52.0 >From b02e39a2780cadbdd77531268e8dc19c9e7cec23 Mon Sep 17 00:00:00 2001 From: Zhao Zhili <[email protected]> Date: Wed, 11 Mar 2026 21:48:33 +0800 Subject: [PATCH 2/2] avformat/rtmpproto: fix listen_timeout conversion for special negative values rtmpproto passes listen_timeout to tcp as milliseconds by multiplying by 1000. However, negative listen_timeout values are special sentinels (e.g. -1 means infinite wait), and should not be multiplied. Fixes ticket #22469. Signed-off-by: Zhao Zhili <[email protected]> --- libavformat/rtmpproto.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index d4c9047266..2fa2843c03 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -2736,7 +2736,8 @@ static int rtmp_open(URLContext *s, const char *uri, int flags, AVDictionary **o if (rt->listen) ff_url_join(buf, sizeof(buf), "tcp", NULL, hostname, port, "?listen&listen_timeout=%d&tcp_nodelay=%d", - rt->listen_timeout * 1000, rt->tcp_nodelay); + rt->listen_timeout < 0 ? -1 : rt->listen_timeout * 1000, + rt->tcp_nodelay); else ff_url_join(buf, sizeof(buf), "tcp", NULL, hostname, port, "?tcp_nodelay=%d", rt->tcp_nodelay); } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
