PR #24932 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24932 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24932.patch
Found-by: Joshua Rogers <[email protected]> >From 8c5a87338778d618865c276934997e8836e78e59 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 06:55:07 +0200 Subject: [PATCH 01/14] avformat/nutenc: Write the fixed frame codes of a stream only into its range Fixes: out of array access Fixes: 0tstIJT8grvU Fixes: AISLE-2026-0111-00174 Out of array read Replicated through UnModified FFmpeg with ASAN Found-by: Joshua Rogers <[email protected]> --- libavformat/nutenc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavformat/nutenc.c b/libavformat/nutenc.c index 55efb114c3..23d8fe086d 100644 --- a/libavformat/nutenc.c +++ b/libavformat/nutenc.c @@ -210,7 +210,7 @@ static void build_frame_code(AVFormatContext *s) frame_size = 1; for (key_frame = 0; key_frame < 2; key_frame++) { - if (!intra_only || !keyframe_0_esc || key_frame != 0) { + if ((!intra_only || !keyframe_0_esc || key_frame != 0) && start2 < end2) { FrameCode *ft = &nut->frame_code[start2]; ft->flags = FLAG_KEY * key_frame; ft->flags |= FLAG_SIZE_MSB | FLAG_CODED_PTS; @@ -235,8 +235,8 @@ static void build_frame_code(AVFormatContext *s) frame_bytes = frame_size * (int64_t)par->bit_rate / (8 * par->sample_rate); } - for (pts = 0; pts < 2; pts++) { - for (pred = 0; pred < 2; pred++) { + for (pts = 0; pts < 2 && start2 < end2; pts++) { + for (pred = 0; pred < 2 && start2 < end2; pred++) { FrameCode *ft = &nut->frame_code[start2]; ft->flags = FLAG_KEY * key_frame; ft->stream_id = stream_id; @@ -247,7 +247,7 @@ static void build_frame_code(AVFormatContext *s) start2++; } } - } else { + } else if (start2 < end2) { FrameCode *ft = &nut->frame_code[start2]; ft->flags = FLAG_KEY | FLAG_SIZE_MSB; ft->stream_id = stream_id; -- 2.52.0 >From 49b921d809ee60af50f61f72785f29dcac64ec20 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 06:56:00 +0200 Subject: [PATCH 02/14] avformat/mxfenc: Fail on unsupported D-10 audio codecs Fixes: out of array read Fixes: jQbdKiuH8zFh Fixes: AISLE-2026-0111-00598 Out of array read Replicated through UnModified FFmpeg with ASAN Found-by: Joshua Rogers <[email protected]> --- libavformat/mxfenc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/mxfenc.c b/libavformat/mxfenc.c index 48043a7d47..37b62dbd2b 100644 --- a/libavformat/mxfenc.c +++ b/libavformat/mxfenc.c @@ -3048,6 +3048,7 @@ static int mxf_init(AVFormatContext *s) if (st->codecpar->codec_id != AV_CODEC_ID_PCM_S16LE && st->codecpar->codec_id != AV_CODEC_ID_PCM_S24LE) { av_log(s, AV_LOG_ERROR, "MXF D-10 only support 16 or 24 bits le audio\n"); + return AVERROR_PATCHWELCOME; } sc->index = INDEX_D10_AUDIO; sc->container_ul = ((MXFStreamContext*)s->streams[0]->priv_data)->container_ul; -- 2.52.0 >From da9cbf3d73c7d33fc4e8326ddabe8068ad696265 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:19:23 +0200 Subject: [PATCH 03/14] avformat/wavenc: Reject peak envelope writing without channels The fix is the one recommended in the report. Fixes: out of array write Fixes: LHiad3FmdAmI Fixes: AISLE-2026-0111-00337 Out of array write Replicated through UnModified FFmpeg with ASAN Found-by: Joshua Rogers <[email protected]> --- libavformat/wavenc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/wavenc.c b/libavformat/wavenc.c index c9ced4a1bd..9de3f7b789 100644 --- a/libavformat/wavenc.c +++ b/libavformat/wavenc.c @@ -194,7 +194,8 @@ static av_cold int peak_init_writer(AVFormatContext *s) "Writing 16 bit peak for 8 bit audio does not make sense\n"); return AVERROR(EINVAL); } - if (par->ch_layout.nb_channels > INT_MAX / (wav->peak_bps * wav->peak_ppv)) + if (par->ch_layout.nb_channels <= 0 || + par->ch_layout.nb_channels > INT_MAX / (wav->peak_bps * wav->peak_ppv)) return AVERROR(ERANGE); wav->size_increment = par->ch_layout.nb_channels * wav->peak_bps * wav->peak_ppv; -- 2.52.0 >From 45aa4159b7af5f7c34fb762d6af3393e944b4038 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 04:50:42 +0200 Subject: [PATCH 04/14] avformat/img2enc: Compute the split plane sizes in 64 bit The fix is the one recommended in the report. Fixes: out of array read Fixes: PbVEU2cWUlo7 Fixes: AISLE-2026-0111-00134 Out of array read Replicated through UnModified FFmpeg with ASAN Found-by: Joshua Rogers <[email protected]> --- libavformat/img2enc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libavformat/img2enc.c b/libavformat/img2enc.c index 1296da8ec7..5a39a1b0c0 100644 --- a/libavformat/img2enc.c +++ b/libavformat/img2enc.c @@ -279,13 +279,15 @@ static int write_packet(AVFormatContext *s, AVPacket *pkt) av_bprint_finalize(&filename, NULL); if (img->split_planes) { - int ysize = par->width * par->height; - int usize = AV_CEIL_RSHIFT(par->width, desc->log2_chroma_w) * AV_CEIL_RSHIFT(par->height, desc->log2_chroma_h); + int64_t ysize = (int64_t)par->width * par->height; + int64_t usize = (int64_t)AV_CEIL_RSHIFT(par->width, desc->log2_chroma_w) * AV_CEIL_RSHIFT(par->height, desc->log2_chroma_h); if (desc->comp[0].depth >= 9) { ysize *= 2; usize *= 2; } - if (ysize + 2*usize + (desc->nb_components > 3) * ysize > pkt->size) { + if (par->width <= 0 || par->height <= 0 || + ysize > pkt->size || + ysize + 2*usize + (desc->nb_components > 3) * ysize > pkt->size) { ret = AVERROR(EINVAL); goto fail; } -- 2.52.0 >From ee381900422bf0e0b31aa7e06c6aa70e090ed00f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:25:51 +0200 Subject: [PATCH 05/14] avformat/apngenc: Reject new extradata larger than INT_MAX The fix is one of the two recommended in the report. Fixes: out of array access (unsupported av_max_alloc() > 2gb) Fixes: zqJ6u5YsGyma Fixes: AISLE-2026-0111-00586 Fixes: AISLE-2026-0110-00586 Negative size memcpy Replicated through API with ASAN, with av_max_alloc() raised above 2 GiB Found-by: Joshua Rogers <[email protected]> --- libavformat/apngenc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/apngenc.c b/libavformat/apngenc.c index 0d56d784f2..f7fefa34a4 100644 --- a/libavformat/apngenc.c +++ b/libavformat/apngenc.c @@ -120,6 +120,8 @@ static int flush_packet(AVFormatContext *format_context, AVPacket *packet) side_data = av_packet_get_side_data(apng->prev_packet, AV_PKT_DATA_NEW_EXTRADATA, &side_data_size); if (side_data_size) { + if (side_data_size > INT_MAX) + return AVERROR(EINVAL); av_freep(&apng->extra_data); apng->extra_data = av_mallocz(side_data_size + AV_INPUT_BUFFER_PADDING_SIZE); if (!apng->extra_data) -- 2.52.0 >From 0f36456ca16f6f7845f441040934cedf7c0402d5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:11:38 +0200 Subject: [PATCH 06/14] avformat/latmenc: Take the extradata size as size_t The fix is the one recommended in the report. Fixes: out of array write (unsupported av_max_alloc() > 2gb) Fixes: uBIqgh88C9dX Fixes: AISLE-2026-0111-00265 Out of array write Replicated through API with ASAN, with av_max_alloc() raised above 4 GiB Found-by: Joshua Rogers <[email protected]> --- libavformat/latmenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/latmenc.c b/libavformat/latmenc.c index 05004048aa..b17ffa254a 100644 --- a/libavformat/latmenc.c +++ b/libavformat/latmenc.c @@ -57,7 +57,7 @@ static const AVClass latm_muxer_class = { .version = LIBAVUTIL_VERSION_INT, }; -static int latm_decode_extradata(AVFormatContext *s, uint8_t *buf, int size) +static int latm_decode_extradata(AVFormatContext *s, uint8_t *buf, size_t size) { LATMContext *ctx = s->priv_data; MPEG4AudioConfig m4ac; -- 2.52.0 >From c9864628538adc515805d3de847696f9d3305cf6 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:29:59 +0200 Subject: [PATCH 07/14] avformat/vvc: Check the number of sublayers Not a security issue, the accesses stay inside the configuration record and only its content is wrong. Fixes: IUOlTN86QoY1 Fixes: AISLE-2026-0111-00046 Array index out of bounds Replicated through API with UBSAN Found-by: Joshua Rogers <[email protected]> --- libavformat/vvc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libavformat/vvc.c b/libavformat/vvc.c index b293ff46de..3a1671d2e7 100644 --- a/libavformat/vvc.c +++ b/libavformat/vvc.c @@ -245,6 +245,8 @@ static int vvcc_parse_vps(GetBitContext *gb, vps_max_layers_minus1 = get_bits(gb, 6); vps_max_sublayers_minus1 = get_bits(gb, 3); + if (vps_max_sublayers_minus1 >= VVC_MAX_SUBLAYERS) + return AVERROR_INVALIDDATA; /* * numTemporalLayers greater than 1 indicates that the stream to which this @@ -310,9 +312,11 @@ static int vvcc_parse_vps(GetBitContext *gb, else vps_pt_present_flag[i] = 1; - if (!vps_default_ptl_dpb_hrd_max_tid_flag) + if (!vps_default_ptl_dpb_hrd_max_tid_flag) { vps_ptl_max_tid[i] = get_bits(gb, 3); - else + if (vps_ptl_max_tid[i] > vps_max_sublayers_minus1) + return AVERROR_INVALIDDATA; + } else vps_ptl_max_tid[i] = vps_max_sublayers_minus1; } @@ -336,6 +340,8 @@ static int vvcc_parse_sps(GetBitContext *gb, skip_bits(gb, 8); // sps_seq_parameter_set_id && sps_video_parameter_set_id sps_max_sublayers_minus1 = get_bits(gb, 3); + if (sps_max_sublayers_minus1 >= VVC_MAX_SUBLAYERS) + return AVERROR_INVALIDDATA; /* * numTemporalLayers greater than 1 indicates that the stream to which this -- 2.52.0 >From 302f93dab7f9c82caff15736d7850bbeaaa3c9a2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 06:05:14 +0200 Subject: [PATCH 08/14] avformat/vvc: Infer the level of the highest sublayer from general_level_idc Not a security issue, the read stays inside the configuration record and only the written level is wrong. Fixes: CSTqrrUsg2ce Array index out of bounds Replicated through API with UBSAN Found during triage of the security report IUOlTN86QoY1 --- libavformat/vvc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/vvc.c b/libavformat/vvc.c index 3a1671d2e7..410deb6390 100644 --- a/libavformat/vvc.c +++ b/libavformat/vvc.c @@ -156,7 +156,7 @@ static void vvcc_update_ptl(VVCDecoderConfigurationRecord *vvcc, FFMAX(vvcc->ptl.sublayer_level_idc[i], ptl->sublayer_level_idc[i]); } else { - if (i == vvcc->num_sublayers - 1) { + if (i == vvcc->num_sublayers - 2) { vvcc->ptl.sublayer_level_idc[i] = vvcc->ptl.general_level_idc; } else { vvcc->ptl.sublayer_level_idc[i] = -- 2.52.0 >From fbd7575a300f79ab0cbcf2e01caee126934ab63c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:32:41 +0200 Subject: [PATCH 09/14] avformat/movenc: Check the pixel format for AVIF output Fixes: NULL pointer dereference Fixes: UwVT8CSrU4Oh Fixes: AISLE-2026-0111-00172 NULL pointer dereference Replicated through UnModified FFmpeg with ASAN,UBSAN Found-by: Joshua Rogers <[email protected]> --- libavformat/movenc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 6492f4ffb3..67af98d67b 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -8401,10 +8401,14 @@ static int mov_init(AVFormatContext *s) av_log(s, AV_LOG_ERROR, "AVIF output supports only video streams\n"); return AVERROR(EINVAL); } + if (!av_pix_fmt_desc_get(s->streams[0]->codecpar->format)) { + av_log(s, AV_LOG_ERROR, "AVIF output requires a known pixel format\n"); + return AVERROR(EINVAL); + } if (s->nb_streams > 1) { const AVPixFmtDescriptor *pixdesc = av_pix_fmt_desc_get(s->streams[1]->codecpar->format); - if (pixdesc->nb_components != 1) { + if (!pixdesc || pixdesc->nb_components != 1) { av_log(s, AV_LOG_ERROR, "Second stream for AVIF (alpha) output must have exactly one plane\n"); return AVERROR(EINVAL); } -- 2.52.0 >From 29eb7bcca6438c35ca0c1e5eed7cec0c8871e71d Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:33:05 +0200 Subject: [PATCH 10/14] avformat/oggenc: Reset the current page when it cannot be buffered On allocation failure the full page stayed in the stream context, and the next segment was added past its 255 entry segment table. Fixes: out of array access Fixes: flOsaBhTFc6F Fixes: AISLE-2026-0111-00072 Negative size memset Replicated through API with ASAN and av_max_alloc() lowered after the header Found-by: Joshua Rogers <[email protected]> --- libavformat/oggenc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/oggenc.c b/libavformat/oggenc.c index f75923e4a7..3da7aeec00 100644 --- a/libavformat/oggenc.c +++ b/libavformat/oggenc.c @@ -192,8 +192,10 @@ static int ogg_buffer_page(AVFormatContext *s, OGGStreamContext *oggstream) OGGPageList **p = &ogg->page_list; OGGPageList *l = av_mallocz(sizeof(*l)); - if (!l) + if (!l) { + ogg_reset_cur_page(oggstream); return AVERROR(ENOMEM); + } l->page = oggstream->page; oggstream->page.start_granule = ogg_granule_to_timestamp(oggstream, oggstream->page.granule); -- 2.52.0 >From 2da11a3b35b50fd7dfb518275eb626b05df55277 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 00:03:31 +0200 Subject: [PATCH 11/14] avformat/oggenc: Propagate page buffering errors Return the error, as recommended in the report AISLE-2026-0111-00072. Not a security issue. Fixes: TjbJ8BXPA93x Found-by: Joshua Rogers <[email protected]> --- libavformat/oggenc.c | 60 ++++++++++++++++++++++++++++---------------- 1 file changed, 38 insertions(+), 22 deletions(-) diff --git a/libavformat/oggenc.c b/libavformat/oggenc.c index 3da7aeec00..f07b986e13 100644 --- a/libavformat/oggenc.c +++ b/libavformat/oggenc.c @@ -221,7 +221,7 @@ static int ogg_buffer_data(AVFormatContext *s, AVStream *st, OGGContext *ogg = s->priv_data; int total_segments = size / 255 + 1; const uint8_t *p = data; - int i, segments, len, flush = 0; + int i, segments, len, ret, flush = 0; // Handles VFR by flushing page because this frame needs to have a timestamp // For theora and VP8, keyframes also need to have a timestamp to correctly mark @@ -232,15 +232,17 @@ static int ogg_buffer_data(AVFormatContext *s, AVStream *st, (ogg_granule_to_timestamp(oggstream, granule) > ogg_granule_to_timestamp(oggstream, oggstream->last_granule) + 1 || ogg_key_granule(oggstream, granule))) { - if (oggstream->page.granule != -1) - ogg_buffer_page(s, oggstream); + if (oggstream->page.granule != -1 && + (ret = ogg_buffer_page(s, oggstream)) < 0) + return ret; flush = 1; } // avoid a continued page if (!header && oggstream->page.size > 0 && MAX_PAGE_SIZE - oggstream->page.size < size) { - ogg_buffer_page(s, oggstream); + if ((ret = ogg_buffer_page(s, oggstream)) < 0) + return ret; } for (i = 0; i < total_segments; ) { @@ -275,17 +277,20 @@ static int ogg_buffer_data(AVFormatContext *s, AVStream *st, time_base, AV_TIME_BASE_Q); if (page->segments_count == 255) { - ogg_buffer_page(s, oggstream); + if ((ret = ogg_buffer_page(s, oggstream)) < 0) + return ret; } else if (!header) { if (ogg->pref_duration > 0 && next - start >= ogg->pref_duration) { - ogg_buffer_page(s, oggstream); + if ((ret = ogg_buffer_page(s, oggstream)) < 0) + return ret; } } } } - if (flush && oggstream->page.granule != -1) - ogg_buffer_page(s, oggstream); + if (flush && oggstream->page.granule != -1 && + (ret = ogg_buffer_page(s, oggstream)) < 0) + return ret; return 0; } @@ -656,24 +661,33 @@ static int ogg_init(AVFormatContext *s) static int ogg_write_header(AVFormatContext *s) { OGGStreamContext *oggstream = NULL; - int i, j; + int i, j, ret; for (j = 0; j < s->nb_streams; j++) { oggstream = s->streams[j]->priv_data; - ogg_buffer_data(s, s->streams[j], oggstream->header[0], - oggstream->header_len[0], 0, 1); + ret = ogg_buffer_data(s, s->streams[j], oggstream->header[0], + oggstream->header_len[0], 0, 1); + if (ret < 0) + return ret; oggstream->page.flags |= 2; // bos - ogg_buffer_page(s, oggstream); + ret = ogg_buffer_page(s, oggstream); + if (ret < 0) + return ret; } for (j = 0; j < s->nb_streams; j++) { AVStream *st = s->streams[j]; oggstream = st->priv_data; for (i = 1; i < 3; i++) { - if (oggstream->header_len[i]) - ogg_buffer_data(s, st, oggstream->header[i], - oggstream->header_len[i], 0, 1); + if (oggstream->header_len[i]) { + ret = ogg_buffer_data(s, st, oggstream->header[i], + oggstream->header_len[i], 0, 1); + if (ret < 0) + return ret; + } } - ogg_buffer_page(s, oggstream); + ret = ogg_buffer_page(s, oggstream); + if (ret < 0) + return ret; } oggstream->page.start_granule = AV_NOPTS_VALUE; @@ -794,15 +808,16 @@ static int ogg_write_packet_internal(AVFormatContext *s, AVPacket *pkt) static int ogg_write_packet(AVFormatContext *s, AVPacket *pkt) { - int i; + int i, ret; if (pkt) return pkt->size || !pkt->side_data_elems ? ogg_write_packet_internal(s, pkt) : 0; for (i = 0; i < s->nb_streams; i++) { OGGStreamContext *oggstream = s->streams[i]->priv_data; - if (oggstream->page.segments_count) - ogg_buffer_page(s, oggstream); + if (oggstream->page.segments_count && + (ret = ogg_buffer_page(s, oggstream)) < 0) + return ret; } ogg_write_pages(s, 2); @@ -811,14 +826,15 @@ static int ogg_write_packet(AVFormatContext *s, AVPacket *pkt) static int ogg_write_trailer(AVFormatContext *s) { - int i; + int i, ret; /* flush current page if needed */ for (i = 0; i < s->nb_streams; i++) { OGGStreamContext *oggstream = s->streams[i]->priv_data; - if (oggstream->page.segments_count) - ogg_buffer_page(s, oggstream); + if (oggstream->page.segments_count && + (ret = ogg_buffer_page(s, oggstream)) < 0) + return ret; } ogg_write_pages(s, 1); -- 2.52.0 >From a5625884e7d3a720b60f9a2c80c1c6f7ac930dcf Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 07:33:31 +0200 Subject: [PATCH 12/14] avformat/options: Set the stream group type after allocating its parameters The fix is the one recommended in the report. Fixes: NULL pointer dereference Fixes: Ks5s2XRvqzXe Fixes: AISLE-2026-0111-00423 NULL pointer dereference Replicated through UnModified FFprobe with an allocation failure injected by gdb Found-by: Joshua Rogers <[email protected]> --- libavformat/options.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/options.c b/libavformat/options.c index 042fe494cf..0dfacc8920 100644 --- a/libavformat/options.c +++ b/libavformat/options.c @@ -490,7 +490,6 @@ AVStreamGroup *avformat_stream_group_create(AVFormatContext *s, stg->av_class = &stream_group_class; av_opt_set_defaults(stg); - stg->type = type; switch (type) { case AV_STREAM_GROUP_PARAMS_IAMF_AUDIO_ELEMENT: stg->params.iamf_audio_element = av_iamf_audio_element_alloc(); @@ -528,6 +527,7 @@ AVStreamGroup *avformat_stream_group_create(AVFormatContext *s, default: goto fail; } + stg->type = type; if (options) { if (av_opt_set_dict2(stg, options, AV_OPT_SEARCH_CHILDREN)) -- 2.52.0 >From 2374a44ff8f48b36e43a34ac86c9c6b099cb126c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:21:59 +0200 Subject: [PATCH 13/14] avformat/mpegtsenc: Check the size of H.26x packets with prepended data Fixes: out of array write (unsupported config av_max_alloc() >2gb) Fixes: GL61hVKFlOuU Fixes: AISLE-2026-0111-00224 Out of array write Replicated through API with ASAN, with av_max_alloc() raised above 2 GiB Found-by: Joshua Rogers <[email protected]> --- libavformat/mpegtsenc.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/libavformat/mpegtsenc.c b/libavformat/mpegtsenc.c index c7733f65e3..8b5b4a922a 100644 --- a/libavformat/mpegtsenc.c +++ b/libavformat/mpegtsenc.c @@ -1897,7 +1897,11 @@ static uint8_t *h26x_prefix_aud(const uint8_t *aud, const int aud_size, const uint8_t *extra_data, const int extra_size, AVPacket *pkt, int *size) { const int sz = 4; //start code size - uint8_t *data = av_malloc(pkt->size + sz + aud_size + extra_size); + uint8_t *data; + + if (pkt->size > INT_MAX - sz - aud_size - extra_size) + return NULL; + data = av_malloc(pkt->size + sz + aud_size + extra_size); if (!data) return NULL; AV_WB32(data, 0x00000001); @@ -2000,7 +2004,11 @@ static int mpegts_write_packet_internal(AVFormatContext *s, AVPacket *pkt) /* Move the AUD up to the beginning of the frame, where the H.264 * spec requires it to appear. Emit the extradata after it. */ PutByteContext pb; - const int new_pkt_size = pkt->size + 1 + extradd; + int new_pkt_size; + + if (pkt->size > INT_MAX - 1 - extradd) + return AVERROR(ENOMEM); + new_pkt_size = pkt->size + 1 + extradd; data = av_malloc(new_pkt_size); if (!data) return AVERROR(ENOMEM); -- 2.52.0 >From 1c67f40ad7688551c1cd99ec3a63c8f175e80787 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:23:11 +0200 Subject: [PATCH 14/14] avformat/gxfenc: Do not read past the end of MPEG-2 packets shorter than 2 bytes Checking the index before the read was suggested in the report. Fixes: NULL pointer dereference Fixes: mOGFdmxuya4M Fixes: AISLE-2026-0111-00065 NULL pointer dereference Replicated through API with ASAN Found-by: Joshua Rogers <[email protected]> --- libavformat/gxfenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/gxfenc.c b/libavformat/gxfenc.c index 023c20d4e5..9bba49ab74 100644 --- a/libavformat/gxfenc.c +++ b/libavformat/gxfenc.c @@ -878,7 +878,7 @@ static int gxf_parse_mpeg_frame(GXFStreamContext *sc, const uint8_t *buf, int si if(c == 0x1B8 && sc->first_gop_closed == -1) /* GOP start code */ sc->first_gop_closed= (buf[i+4]>>6)&1; } - return (buf[i+1]>>3)&7; + return i + 1 < size ? (buf[i+1]>>3)&7 : 0; } static int gxf_write_media_preamble(AVFormatContext *s, AVPacket *pkt, int size) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
