PR #24470 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24470 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24470.patch
Fixes: negative-size-param Fixes: poc.aac Fixes: vTQwk65AUmDs Found-by: Zheng Yu <[email protected]> >From e7b325b25da5e1fd54588fcd74ebf7857668b42f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 7 Sep 2026 00:37:01 +0200 Subject: [PATCH 1/2] avformat/rtpenc_latm: check that the PayloadLengthInfo fits the RTP payload Fixes: negative-size-param Fixes: poc.aac Fixes: vTQwk65AUmDs Found-by: Zheng Yu <[email protected]> --- libavformat/rtpenc_latm.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/rtpenc_latm.c b/libavformat/rtpenc_latm.c index 7bda66af95..5ced2d69e3 100644 --- a/libavformat/rtpenc_latm.c +++ b/libavformat/rtpenc_latm.c @@ -41,6 +41,11 @@ void ff_rtp_send_latm(AVFormatContext *s1, const uint8_t *buff, int size) /* PayloadLengthInfo() */ header_size = size/0xFF + 1; + if (header_size >= s->max_payload_size) { + av_log(s1, AV_LOG_ERROR, "LATM length header of %d bytes does not fit " + "the RTP payload of %d bytes\n", header_size, s->max_payload_size); + return; + } memset(s->buf, 0xFF, header_size - 1); s->buf[header_size - 1] = size % 0xFF; -- 2.52.0 >From abc4ff5249fe507a97c955f31aecc5b3039aa444 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 13 Sep 2026 02:19:21 +0200 Subject: [PATCH 2/2] avformat/rtpenc: skip the ADTS header once for both AAC payload formats --- libavformat/rtpenc.c | 18 +++++++++++++++--- libavformat/rtpenc_aac.c | 10 ---------- libavformat/rtpenc_latm.c | 6 ------ 3 files changed, 15 insertions(+), 19 deletions(-) diff --git a/libavformat/rtpenc.c b/libavformat/rtpenc.c index 25b1f8640d..7c86b50975 100644 --- a/libavformat/rtpenc.c +++ b/libavformat/rtpenc.c @@ -597,12 +597,24 @@ static int rtp_write_packet(AVFormatContext *s1, AVPacket *pkt) case AV_CODEC_ID_MPEG2VIDEO: ff_rtp_send_mpegvideo(s1, pkt->data, size); break; - case AV_CODEC_ID_AAC: + case AV_CODEC_ID_AAC: { + const uint8_t *aac_frame = pkt->data; + + /* skip ADTS header, if present */ + if (!st->codecpar->extradata_size) { + if (size < 7) { + av_log(s1, AV_LOG_ERROR, "AAC packet too small for ADTS header\n"); + break; + } + aac_frame += 7; + size -= 7; + } if (s->flags & FF_RTP_FLAG_MP4A_LATM) - ff_rtp_send_latm(s1, pkt->data, size); + ff_rtp_send_latm(s1, aac_frame, size); else - ff_rtp_send_aac(s1, pkt->data, size); + ff_rtp_send_aac(s1, aac_frame, size); break; + } case AV_CODEC_ID_AMR_NB: case AV_CODEC_ID_AMR_WB: ff_rtp_send_amr(s1, pkt->data, size); diff --git a/libavformat/rtpenc_aac.c b/libavformat/rtpenc_aac.c index 96bdb3f706..e4df542a36 100644 --- a/libavformat/rtpenc_aac.c +++ b/libavformat/rtpenc_aac.c @@ -32,16 +32,6 @@ void ff_rtp_send_aac(AVFormatContext *s1, const uint8_t *buff, int size) int len, max_packet_size = s->max_payload_size - max_au_headers_size; uint8_t *p; - /* skip ADTS header, if present */ - if ((s1->streams[0]->codecpar->extradata_size) == 0) { - if (size < 7) { - av_log(s1, AV_LOG_ERROR, "AAC packet too small for ADTS header\n"); - return; - } - size -= 7; - buff += 7; - } - /* test if the packet must be sent */ len = (s->buf_ptr - s->buf); if (s->num_frames && diff --git a/libavformat/rtpenc_latm.c b/libavformat/rtpenc_latm.c index 5ced2d69e3..e0870228e4 100644 --- a/libavformat/rtpenc_latm.c +++ b/libavformat/rtpenc_latm.c @@ -33,12 +33,6 @@ void ff_rtp_send_latm(AVFormatContext *s1, const uint8_t *buff, int size) int offset = 0; int len = 0; - /* skip ADTS header, if present */ - if ((s1->streams[0]->codecpar->extradata_size) == 0) { - size -= 7; - buff += 7; - } - /* PayloadLengthInfo() */ header_size = size/0xFF + 1; if (header_size >= s->max_payload_size) { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
