PR #24770 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24770 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24770.patch
Fixes: out of array write with an out of range stream index in the amovie seek command Fixes: CHE5mlmUNamc Found-by: Hongduo Zhao Replicated through UnModified FFmpeg >From 1a1cb4af7c06af28d8bf5bf46fd48f42995a7a95 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 29 Sep 2026 18:36:48 +0200 Subject: [PATCH 1/2] avfilter/src_movie: reject out of range stream indexes in the seek command Fixes: out of array write with an out of range stream index in the amovie seek command Fixes: CHE5mlmUNamc Found-by: Hongduo Zhao Replicated through UnModified FFmpeg --- libavfilter/src_movie.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavfilter/src_movie.c b/libavfilter/src_movie.c index 5d4f6e31e6..af69294909 100644 --- a/libavfilter/src_movie.c +++ b/libavfilter/src_movie.c @@ -653,6 +653,8 @@ static int process_command(AVFilterContext *ctx, const char *cmd, const char *ar if (sscanf(args, "%i|%"SCNi64"|%i %1s", &idx, &ts, &flags, tail) != 3) return AVERROR(EINVAL); + if (idx + 1U > movie->format_ctx->nb_streams) + return AVERROR(EINVAL); ret = av_seek_frame(movie->format_ctx, idx, ts, flags); if (ret < 0) -- 2.52.0 >From a1eabf5db06eedd055541d756799a8460d0b7869 Mon Sep 17 00:00:00 2001 From: Hongduo Zhao <[email protected]> Date: Tue, 29 Sep 2026 01:57:32 +0200 Subject: [PATCH 2/2] avformat/seek: reject out of range stream indexes in av_seek_frame() This is hardening against API misuse; a caller passing such an index is the bug, see the amovie "seek" command fix for CHE5mlmUNamc. Found-by: Hongduo Zhao --- libavformat/seek.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/seek.c b/libavformat/seek.c index c0d94371e6..31e3e6dd69 100644 --- a/libavformat/seek.c +++ b/libavformat/seek.c @@ -643,6 +643,9 @@ int av_seek_frame(AVFormatContext *s, int stream_index, { int ret; + if (stream_index < -1 || stream_index >= (int)s->nb_streams) + return AVERROR(EINVAL); + if (ffifmt(s->iformat)->read_seek2 && !ffifmt(s->iformat)->read_seek) { int64_t min_ts = INT64_MIN, max_ts = INT64_MAX; if ((flags & AVSEEK_FLAG_BACKWARD)) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
