PR #24916 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24916 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24916.patch
Found-by: Joshua Rogers <[email protected]> >From 008ae265c847ee6783dc38241efb37fbe709511c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 06:53:14 +0200 Subject: [PATCH 01/18] avformat/rtmppkt: Make the packet header buffer large enough The fix is the one recommended in the report. Fixes: out of array write Fixes: BvkwW4Yd19HN Fixes: AISLE-2026-0111-00462 Stack out of array write Replicated through UnModified FFmpeg with ASAN Found-by: Joshua Rogers <[email protected]> --- libavformat/rtmppkt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtmppkt.c b/libavformat/rtmppkt.c index e52307c5d6..ee687d4791 100644 --- a/libavformat/rtmppkt.c +++ b/libavformat/rtmppkt.c @@ -314,7 +314,7 @@ int ff_rtmp_packet_write(URLContext *h, RTMPPacket *pkt, int chunk_size, RTMPPacket **prev_pkt_ptr, int *nb_prev_pkt) { - uint8_t pkt_hdr[16], *p = pkt_hdr; + uint8_t pkt_hdr[18], *p = pkt_hdr; int mode = RTMP_PS_TWELVEBYTES; int off = 0; int written = 0; -- 2.52.0 >From 47bd3bd1d156b186f52cf2cb0b5a2085a28be634 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 06:53:33 +0200 Subject: [PATCH 02/18] avformat/rtmppkt: Terminate truncated AMF strings at the bytes read Fixes: use of uninitialized memory Fixes: Fid2Ij03ilhP Fixes: AISLE-2026-0111-00158 Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind Found-by: Joshua Rogers <[email protected]> --- libavformat/rtmppkt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtmppkt.c b/libavformat/rtmppkt.c index ee687d4791..98fb98a9bc 100644 --- a/libavformat/rtmppkt.c +++ b/libavformat/rtmppkt.c @@ -551,7 +551,7 @@ static int amf_get_field_value2(GetByteContext *gb, return -1; if (dst_size < len + 1) len = dst_size - 1; - bytestream2_get_buffer(gb, dst, len); + len = bytestream2_get_buffer(gb, dst, len); dst[len] = 0; break; default: -- 2.52.0 >From 3c8c68db663f2175b1b9e2d729bca33a1781fbd3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 06:54:36 +0200 Subject: [PATCH 03/18] avformat/whip: Only accept http resource urls from the Location header Fixes: local file truncation Fixes: NAqYLq2oM12K Fixes: AISLE-2026-0111-00068 Local file truncation Replicated through UnModified FFmpeg with a local WHIP test server Found-by: Joshua Rogers <[email protected]> --- libavformat/whip.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/whip.c b/libavformat/whip.c index cea9941878..d52b87976f 100644 --- a/libavformat/whip.c +++ b/libavformat/whip.c @@ -829,6 +829,12 @@ static int exchange_sdp(AVFormatContext *s) } if (ff_http_get_new_location(whip_uc)) { + proto_name = avio_find_protocol_name(ff_http_get_new_location(whip_uc)); + if (!proto_name || !av_strstart(proto_name, "http", NULL)) { + av_log(whip, AV_LOG_ERROR, "Unsupported resource url %s\n", ff_http_get_new_location(whip_uc)); + ret = AVERROR_INVALIDDATA; + goto end; + } whip->whip_resource_url = av_strdup(ff_http_get_new_location(whip_uc)); if (!whip->whip_resource_url) { ret = AVERROR(ENOMEM); -- 2.52.0 >From 4e16f869516dff4ed5a24c0ce364a49a7a165512 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:07:36 +0200 Subject: [PATCH 04/18] avformat/rtpenc_vc2hq: Stop on data units shorter than their header The fix is the one recommended in the report. Fixes: infinite loop Fixes: HRhmcrDPRPyf Fixes: AISLE-2026-0111-00262 Infinite loop Replicated through UnModified FFmpeg with valid Dirac samples Found-by: Joshua Rogers <[email protected]> --- libavformat/rtpenc_vc2hq.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/libavformat/rtpenc_vc2hq.c b/libavformat/rtpenc_vc2hq.c index 3b7147dfe2..1cff2af9fd 100644 --- a/libavformat/rtpenc_vc2hq.c +++ b/libavformat/rtpenc_vc2hq.c @@ -119,11 +119,11 @@ void ff_rtp_send_vc2hq(AVFormatContext *ctx, const uint8_t *frame_buf, int frame uint8_t parse_code; uint32_t unit_size; - while (unit < end) { + while (end - unit >= DIRAC_DATA_UNIT_HEADER_SIZE) { parse_code = unit[4]; unit_size = AV_RB32(&unit[5]); - if (unit_size > end - unit) + if (unit_size < DIRAC_DATA_UNIT_HEADER_SIZE || unit_size > end - unit) break; switch (parse_code) { @@ -131,13 +131,11 @@ void ff_rtp_send_vc2hq(AVFormatContext *ctx, const uint8_t *frame_buf, int frame /* end of sequence */ case DIRAC_PCODE_SEQ_HEADER: case DIRAC_PCODE_END_SEQ: - if (unit_size >= DIRAC_DATA_UNIT_HEADER_SIZE) - send_packet(ctx, parse_code, 0, unit + DIRAC_DATA_UNIT_HEADER_SIZE, unit_size - DIRAC_DATA_UNIT_HEADER_SIZE, 0, 0, 0); + send_packet(ctx, parse_code, 0, unit + DIRAC_DATA_UNIT_HEADER_SIZE, unit_size - DIRAC_DATA_UNIT_HEADER_SIZE, 0, 0, 0); break; /* HQ picture */ case DIRAC_PCODE_PICTURE_HQ: - if (unit_size >= DIRAC_DATA_UNIT_HEADER_SIZE) - send_picture(ctx, unit + DIRAC_DATA_UNIT_HEADER_SIZE, unit_size - DIRAC_DATA_UNIT_HEADER_SIZE, interlaced); + send_picture(ctx, unit + DIRAC_DATA_UNIT_HEADER_SIZE, unit_size - DIRAC_DATA_UNIT_HEADER_SIZE, interlaced); break; /* parse codes without specification */ case DIRAC_PCODE_AUX: -- 2.52.0 >From 51822cb585f9adf8b04a29279a1abd46c6a08937 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:08:16 +0200 Subject: [PATCH 05/18] avformat/rtpenc_vc2hq: Limit picture fragments to 65535 bytes Fixes: infinite loop Fixes: 8SQ71eGHsyRR Infinite loop Replicated through UnModified FFmpeg with a vc2 stream from the vc2 encoder Found during triage of the security report HRhmcrDPRPyf --- libavformat/rtpenc_vc2hq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtpenc_vc2hq.c b/libavformat/rtpenc_vc2hq.c index 1cff2af9fd..eb48233598 100644 --- a/libavformat/rtpenc_vc2hq.c +++ b/libavformat/rtpenc_vc2hq.c @@ -98,7 +98,7 @@ static int send_picture(AVFormatContext *ctx, const uint8_t *buf, int size, int size -= frag_len; while (size > 0) { - frag_len = FFMIN(rtp_ctx->max_payload_size - 20 /* pl header */, size); + frag_len = FFMIN3(rtp_ctx->max_payload_size - 20 /* pl header */, size, UINT16_MAX); AV_WB16(&info_hdr[ 8], frag_len); AV_WB16(&info_hdr[10], 1 /* nr. of slices */); AV_WB16(&info_hdr[12], 0 /* slice x */); -- 2.52.0 >From b065fb45ed68b7e5914ee8cbfb206782195fad6b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:31:52 +0200 Subject: [PATCH 06/18] avformat/rtpenc_vc2hq: Check the bit reader initialization Fixes: NULL pointer dereference Fixes: nd3rLqSpKgo5 Fixes: AISLE-2026-0111-00571 NULL pointer dereference Replicated through UnModified FFmpeg with ASAN,UBSAN Found-by: Joshua Rogers <[email protected]> --- libavformat/rtpenc_vc2hq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/rtpenc_vc2hq.c b/libavformat/rtpenc_vc2hq.c index eb48233598..429ea7746a 100644 --- a/libavformat/rtpenc_vc2hq.c +++ b/libavformat/rtpenc_vc2hq.c @@ -69,7 +69,8 @@ static int send_picture(AVFormatContext *ctx, const uint8_t *buf, int size, int size -= DIRAC_PIC_NR_SIZE; second_field = interlaced && (pic_nr & 0x01); - init_get_bits(&gc, buf, 8 * size); + if (init_get_bits8(&gc, buf, size) < 0) + return AVERROR_INVALIDDATA; get_interleaved_ue_golomb(&gc); /* wavelet_idx */ wavelet_depth = get_interleaved_ue_golomb(&gc); get_interleaved_ue_golomb(&gc); /* num_x */ -- 2.52.0 >From 85e1c56091cba81045187152b87db95da3338498 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:31:35 +0200 Subject: [PATCH 07/18] avformat/rtpdec_rfc4175: Clear the frame buffer The fix is the one recommended in the report. Fixes: use of uninitialized memory Fixes: V8a3e2cGQI7w Fixes: AISLE-2026-0111-00477 Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind Found-by: Joshua Rogers <[email protected]> --- libavformat/rtpdec_rfc4175.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c index b49fc55d2d..41bf4a2c5d 100644 --- a/libavformat/rtpdec_rfc4175.c +++ b/libavformat/rtpdec_rfc4175.c @@ -260,7 +260,7 @@ static int rfc4175_handle_packet(AVFormatContext *ctx, PayloadContext *data, } if (!data->frame) - data->frame = av_malloc(data->frame_size); + data->frame = av_mallocz(data->frame_size + AV_INPUT_BUFFER_PADDING_SIZE); data->timestamp = *timestamp; -- 2.52.0 >From 2dd29136987d09dd8ef69838675eb6ab62d289f6 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:40:41 +0200 Subject: [PATCH 08/18] avformat/rtpdec_h264: Ignore framesize attributes without a height Fixes: out of array read Fixes: xfnEsbsbvEIX Fixes: AISLE-2026-0111-00033 Stack out of array read Replicated through UnModified FFmpeg (ffprobe) with ASAN Found-by: Joshua Rogers <[email protected]> --- libavformat/rtpdec_h264.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/rtpdec_h264.c b/libavformat/rtpdec_h264.c index 72724c2909..c145edaa5e 100644 --- a/libavformat/rtpdec_h264.c +++ b/libavformat/rtpdec_h264.c @@ -198,6 +198,9 @@ void ff_h264_parse_framesize(AVCodecParameters *par, const char *p) *dst++ = *p++; *dst = '\0'; + if (*p != '-') + return; + // a='framesize:96 320-240' // set our parameters par->width = atoi(buf1); -- 2.52.0 >From 2d36e0882a46f6373e9fe2979a19f757ab934e83 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:41:44 +0200 Subject: [PATCH 09/18] avformat/rdt: Check that the stream has an RMStream Fixes: NULL pointer dereference Fixes: PXsIMPp0wPaW Fixes: AISLE-2026-0111-00472 NULL pointer dereference Replicated through UnModified FFmpeg (ffprobe) with ASAN,UBSAN Found-by: Joshua Rogers <[email protected]> --- libavformat/rdt.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/rdt.c b/libavformat/rdt.c index 77048d59c8..725793eb01 100644 --- a/libavformat/rdt.c +++ b/libavformat/rdt.c @@ -301,6 +301,9 @@ rdt_parse_packet (AVFormatContext *ctx, PayloadContext *rdt, AVStream *st, { int seq = 1, res; + if (st->index >= rdt->nb_rmst || !rdt->rmst[st->index]) + return AVERROR_INVALIDDATA; + if (rdt->audio_pkt_cnt == 0) { FFIOContext pb; int pos, rmflags; -- 2.52.0 >From e57688f0a830c68a09e23d69b0ebcfdd4a15c76e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:34:46 +0200 Subject: [PATCH 10/18] avformat/sdp: Set the address type in resolve_destination() without network The fix is the one recommended in the report. Fixes: use of uninitialized memory Fixes: YcBNmSVOpm32 Fixes: AISLE-2026-0111-00272 Use of uninitialized memory Replicated through API with Valgrind in a --disable-network build Found-by: Joshua Rogers <[email protected]> --- libavformat/sdp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/sdp.c b/libavformat/sdp.c index f6798f4bd9..4eeccf92b4 100644 --- a/libavformat/sdp.c +++ b/libavformat/sdp.c @@ -121,6 +121,7 @@ static int resolve_destination(char *dest_addr, int size, char *type, static int resolve_destination(char *dest_addr, int size, char *type, int type_size) { + av_strlcpy(type, "IP4", type_size); return 0; } #endif -- 2.52.0 >From 025d18a45e5ed099bf0a992887e79594b76c08fe Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:17:58 +0200 Subject: [PATCH 11/18] avformat/mmst: Fail when the ASF header has no packet size or no streams The fix is the one recommended in the report. Fixes: NULL pointer dereference Fixes: 1eA5JUo2ED6K Fixes: AISLE-2026-0111-00154 NULL pointer dereference Replicated through UnModified FFmpeg with ASAN,UBSAN Found-by: Joshua Rogers <[email protected]> --- libavformat/mmst.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/mmst.c b/libavformat/mmst.c index 59d3f9726e..78296a1f26 100644 --- a/libavformat/mmst.c +++ b/libavformat/mmst.c @@ -567,8 +567,10 @@ static int mms_open(URLContext *h, const char *uri, int flags) } mms->header_parsed = 1; - if (!mms->asf_packet_len || !mms->stream_num) + if (!mms->asf_packet_len || !mms->stream_num) { + err = AVERROR_INVALIDDATA; goto fail; + } clear_stream_buffers(mms); err = mms_safe_send_recv(mmst, send_stream_selection_request, SC_PKT_STREAM_ID_ACCEPTED); -- 2.52.0 >From 6fe24d078f0bf5316cdede128a81e795f552dd0b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:26:40 +0200 Subject: [PATCH 12/18] avformat/rtpdec_asf: Reject ASF packet lengths beyond the RTP payload The check is the one recommended in the report. Fixes: use of uninitialized memory Fixes: 9sWoEae5AABB Fixes: AISLE-2026-0111-00026 Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind Found-by: Joshua Rogers <[email protected]> --- libavformat/rtpdec_asf.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/libavformat/rtpdec_asf.c b/libavformat/rtpdec_asf.c index f7fa69e27f..1360a39191 100644 --- a/libavformat/rtpdec_asf.c +++ b/libavformat/rtpdec_asf.c @@ -264,12 +264,11 @@ static int asfrtp_parse_packet(AVFormatContext *s, PayloadContext *asf, int cur_len = start_off + len_off - off; int prev_len = out_len; out_len += cur_len; - if (FFMIN(cur_len, len - off) < 0) + if (cur_len < 0 || cur_len > len - off) return -1; if ((res = av_reallocp(&asf->buf, out_len)) < 0) return res; - memcpy(asf->buf + prev_len, buf + off, - FFMIN(cur_len, len - off)); + memcpy(asf->buf + prev_len, buf + off, cur_len); avio_skip(pb, cur_len); } } -- 2.52.0 >From d4966e2a6d840d161579e2421870532cf92f6596 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:35:27 +0200 Subject: [PATCH 13/18] avformat/rtpenc_vc2hq: Stop at the picture end in the quantization matrix loop Fixes: Timeout Fixes: 6xQwaeAd0XlH Timeout Replicated through UnModified FFmpeg (-strict experimental) with time measurement Found during triage of the security report nd3rLqSpKgo5 --- libavformat/rtpenc_vc2hq.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/rtpenc_vc2hq.c b/libavformat/rtpenc_vc2hq.c index 429ea7746a..87961c8dd7 100644 --- a/libavformat/rtpenc_vc2hq.c +++ b/libavformat/rtpenc_vc2hq.c @@ -81,6 +81,8 @@ static int send_picture(AVFormatContext *ctx, const uint8_t *buf, int size, int get_interleaved_ue_golomb(&gc); for(lvl = 0; lvl < wavelet_depth; lvl++) { + if (get_bits_left(&gc) < 0) + return AVERROR_INVALIDDATA; get_interleaved_ue_golomb(&gc); get_interleaved_ue_golomb(&gc); get_interleaved_ue_golomb(&gc); -- 2.52.0 >From ce88026b32a05dc6c4a7a404c67736635cbf741a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 03:30:53 +0200 Subject: [PATCH 14/18] avformat/rtpenc_vc2hq: Send the data unit that has no next parse offset Found during triage of the security report HRhmcrDPRPyf --- libavformat/rtpenc_vc2hq.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/rtpenc_vc2hq.c b/libavformat/rtpenc_vc2hq.c index 87961c8dd7..c84e2ea65c 100644 --- a/libavformat/rtpenc_vc2hq.c +++ b/libavformat/rtpenc_vc2hq.c @@ -125,6 +125,8 @@ void ff_rtp_send_vc2hq(AVFormatContext *ctx, const uint8_t *frame_buf, int frame while (end - unit >= DIRAC_DATA_UNIT_HEADER_SIZE) { parse_code = unit[4]; unit_size = AV_RB32(&unit[5]); + if (!unit_size) + unit_size = end - unit; if (unit_size < DIRAC_DATA_UNIT_HEADER_SIZE || unit_size > end - unit) break; -- 2.52.0 >From a921ff75276bb934e7b51d210c94f6f1ca4b31b3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 03:39:30 +0200 Subject: [PATCH 15/18] avformat/rtpenc_vc2hq: Write the extended sequence number RFC 8450 requires the high order 16 bits of the 32 bit packet sequence number in the payload header, 0 was always written. Count the wraps of the RTP sequence number in the RTP muxer. Found during triage of the security report HRhmcrDPRPyf --- libavformat/rtpenc.c | 2 ++ libavformat/rtpenc.h | 1 + libavformat/rtpenc_vc2hq.c | 2 +- 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/rtpenc.c b/libavformat/rtpenc.c index 7c86b50975..85a68cb035 100644 --- a/libavformat/rtpenc.c +++ b/libavformat/rtpenc.c @@ -378,6 +378,8 @@ void ff_rtp_send_data(AVFormatContext *s1, const uint8_t *buf1, int len, int m) avio_flush(s1->pb); s->seq = (s->seq + 1) & 0xffff; + if (!s->seq) + s->seq_high++; s->octet_count += len; s->packet_count++; } diff --git a/libavformat/rtpenc.h b/libavformat/rtpenc.h index ba88bfefc0..3ef02ac10d 100644 --- a/libavformat/rtpenc.h +++ b/libavformat/rtpenc.h @@ -32,6 +32,7 @@ struct RTPMuxContext { uint32_t ssrc; const char *cname; int seq; + uint16_t seq_high; uint32_t timestamp; uint32_t base_timestamp; uint32_t cur_timestamp; diff --git a/libavformat/rtpenc_vc2hq.c b/libavformat/rtpenc_vc2hq.c index c84e2ea65c..26c9604495 100644 --- a/libavformat/rtpenc_vc2hq.c +++ b/libavformat/rtpenc_vc2hq.c @@ -43,7 +43,7 @@ static int send_packet(AVFormatContext *ctx, uint8_t parse_code, int info_hdr_si return AVERROR_INVALIDDATA; } - AV_WB16(&rtp_ctx->buf[0], 0); /* extended sequence number */ + AV_WB16(&rtp_ctx->buf[0], rtp_ctx->seq_high); /* extended sequence number */ AV_WB8 (&rtp_ctx->buf[2], i ? (f ? (0x03) : (0x02)) : 0x00); /* flags: interlaced, second field */ AV_WB8 (&rtp_ctx->buf[3], parse_code); if (size > 0) -- 2.52.0 >From 074cf794129b1f10727dd4de1ba421e093b7e277 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 02:43:31 +0200 Subject: [PATCH 16/18] avformat/rtpenc_vc2hq: Reject transform parameters that run past the picture Not a security issue. Fixes: GOnB0bwaMBbJ Byte after the picture sent Replicated through UnModified FFmpeg Found during triage of the security report nd3rLqSpKgo5 --- libavformat/rtpenc_vc2hq.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/rtpenc_vc2hq.c b/libavformat/rtpenc_vc2hq.c index 26c9604495..a73c3b615d 100644 --- a/libavformat/rtpenc_vc2hq.c +++ b/libavformat/rtpenc_vc2hq.c @@ -89,6 +89,8 @@ static int send_picture(AVFormatContext *ctx, const uint8_t *buf, int size, int } frag_len = (get_bits_count(&gc) + 7) / 8; /* length of transform parameters */ + if (get_bits_left(&gc) < 0) + return AVERROR_INVALIDDATA; AV_WB32(&info_hdr[ 0], pic_nr); AV_WB16(&info_hdr[ 4], prefix_bytes); -- 2.52.0 >From 29ec0cfcd33f4fbaad98d55161bd22975c152c7b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 02:50:32 +0200 Subject: [PATCH 17/18] avformat/rtpenc_vc2hq: Reject transform parameters longer than 65535 bytes Not a security issue. Fixes: GOnB0bwaMBbJ Truncated transform parameters Replicated through UnModified FFmpeg Found during triage of the security report nd3rLqSpKgo5 --- libavformat/rtpenc_vc2hq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/rtpenc_vc2hq.c b/libavformat/rtpenc_vc2hq.c index a73c3b615d..65aaeb36df 100644 --- a/libavformat/rtpenc_vc2hq.c +++ b/libavformat/rtpenc_vc2hq.c @@ -58,7 +58,7 @@ static int send_picture(AVFormatContext *ctx, const uint8_t *buf, int size, int GetBitContext gc; int lvl, second_field; uint32_t pic_nr, wavelet_depth, prefix_bytes, size_scaler; - uint16_t frag_len; + int frag_len; char *info_hdr = &rtp_ctx->buf[4]; if (size < DIRAC_PIC_NR_SIZE) @@ -89,7 +89,7 @@ static int send_picture(AVFormatContext *ctx, const uint8_t *buf, int size, int } frag_len = (get_bits_count(&gc) + 7) / 8; /* length of transform parameters */ - if (get_bits_left(&gc) < 0) + if (get_bits_left(&gc) < 0 || frag_len > UINT16_MAX) return AVERROR_INVALIDDATA; AV_WB32(&info_hdr[ 0], pic_nr); -- 2.52.0 >From 31fe2af82c0bb5577be5cc238c9164bd200d2b83 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 03:08:56 +0200 Subject: [PATCH 18/18] avformat/rtpenc_vc2hq: Read the quantization matrix as specified Not a security issue. Fixes: lJyVgdTNfBGb Wrong transform parameters length Replicated through UnModified FFmpeg Found during triage of the security report nd3rLqSpKgo5 --- libavformat/rtpenc_vc2hq.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/libavformat/rtpenc_vc2hq.c b/libavformat/rtpenc_vc2hq.c index 65aaeb36df..3e94e361be 100644 --- a/libavformat/rtpenc_vc2hq.c +++ b/libavformat/rtpenc_vc2hq.c @@ -78,14 +78,16 @@ static int send_picture(AVFormatContext *ctx, const uint8_t *buf, int size, int prefix_bytes = get_interleaved_ue_golomb(&gc); size_scaler = get_interleaved_ue_golomb(&gc); /* pass the quantization matrices */ - get_interleaved_ue_golomb(&gc); - for(lvl = 0; lvl < wavelet_depth; lvl++) - { - if (get_bits_left(&gc) < 0) - return AVERROR_INVALIDDATA; - get_interleaved_ue_golomb(&gc); - get_interleaved_ue_golomb(&gc); + if (get_bits1(&gc)) { get_interleaved_ue_golomb(&gc); + for(lvl = 0; lvl < wavelet_depth; lvl++) + { + if (get_bits_left(&gc) < 0) + return AVERROR_INVALIDDATA; + get_interleaved_ue_golomb(&gc); + get_interleaved_ue_golomb(&gc); + get_interleaved_ue_golomb(&gc); + } } frag_len = (get_bits_count(&gc) + 7) / 8; /* length of transform parameters */ -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
