PR #24933 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24933 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24933.patch
Found-by: Joshua Rogers <[email protected]> >From 8b64d85c9aa0b3ae1294ef5d17e508fdc6abcafa Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:21:59 +0200 Subject: [PATCH 1/7] avformat/tee: Do not receive from the filters of a slave that failed The continue was suggested in the report. Hardening for ZKrMQAvMQyye (AISLE-2026-0111-00318) Found-by: Joshua Rogers <[email protected]> --- libavformat/tee.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/tee.c b/libavformat/tee.c index fedc401764..9407800585 100644 --- a/libavformat/tee.c +++ b/libavformat/tee.c @@ -585,6 +585,7 @@ static int tee_write_packet(AVFormatContext *avf, AVPacket *pkt) ret = tee_process_slave_failure(avf, i, ret); if (!ret_all && ret < 0) ret_all = ret; + continue; } while(1) { -- 2.52.0 >From 0d72231cf326a7c5bb3640ce4cdfd5c8e1d0ec55 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:21:59 +0200 Subject: [PATCH 2/7] avformat/mux: Reject packets with negative size Checking in the generic write path was suggested in the report. Hardening for b64ckvFAT3zF (AISLE-2026-0111-00311) Negative size memcpy Replicated through API with ASAN Found-by: Joshua Rogers <[email protected]> --- libavformat/mux.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/mux.c b/libavformat/mux.c index 01115e9d21..0198b36f40 100644 --- a/libavformat/mux.c +++ b/libavformat/mux.c @@ -771,6 +771,11 @@ static int check_packet(AVFormatContext *s, AVPacket *pkt) return AVERROR(EINVAL); } + if (pkt->size < 0) { + av_log(s, AV_LOG_ERROR, "Invalid packet size: %d\n", pkt->size); + return AVERROR(EINVAL); + } + return 0; } -- 2.52.0 >From 326cf345ed57e5cbda12b118ce74786078f9295a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:22:46 +0200 Subject: [PATCH 3/7] avformat/libcurl: Parse a NUL terminated copy of the header line Copying the line was suggested in the report. Hardening for YIGMmuDCkSUr (AISLE-2026-0111-00055, AISLE-2026-0110-00055) Found-by: Joshua Rogers <[email protected]> --- libavformat/libcurl.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/libavformat/libcurl.c b/libavformat/libcurl.c index 80c1f7a9fa..c24edcd9c5 100644 --- a/libavformat/libcurl.c +++ b/libavformat/libcurl.c @@ -488,10 +488,8 @@ static int verify_content_range(CurlContext *c, int64_t start, int64_t end, return 1; } -static size_t header_callback(char *ptr, size_t size, size_t nitems, void *userdata) +static size_t parse_header(CurlContext *c, const char *ptr, size_t len) { - CurlContext *c = userdata; - size_t len = size * nitems; size_t n = len; long status = 0; @@ -633,6 +631,20 @@ static size_t header_callback(char *ptr, size_t size, size_t nitems, void *userd return len; } +static size_t header_callback(char *ptr, size_t size, size_t nitems, void *userdata) +{ + size_t len = size * nitems; + char *line = av_malloc(len + 1); + + if (!line) + return CURL_WRITEFUNC_ERROR; + memcpy(line, ptr, len); + line[len] = 0; + len = parse_header(userdata, line, len); + av_free(line); + return len; +} + static int xferinfo_callback(void *userdata, curl_off_t dltotal, curl_off_t dlnow, curl_off_t ultotal, curl_off_t ulnow) { -- 2.52.0 >From e0768598f44f2253b29ccd6464b9ae80823ddd87 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:22:46 +0200 Subject: [PATCH 4/7] avformat/rtpdec_av1: Read the OBU header byte after the size checks Moving the read after the checks was suggested in the report. Hardening for R5y4vDJ078Lr (AISLE-2026-0111-00004) Found-by: Joshua Rogers <[email protected]> --- libavformat/rtpdec_av1.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/rtpdec_av1.c b/libavformat/rtpdec_av1.c index f6b1048328..a45a2f149d 100644 --- a/libavformat/rtpdec_av1.c +++ b/libavformat/rtpdec_av1.c @@ -228,8 +228,6 @@ static int av1_handle_packet(AVFormatContext *ctx, PayloadContext *data, rem_pkt_size -= num_lebs; buf_ptr += num_lebs; } - // read first byte (which is the header byte only for non-fragmented elements) - obu_hdr = *buf_ptr; if (obu_size > rem_pkt_size) { av_log(ctx, AV_LOG_ERROR, "AV1 OBU size %u larger than remaining pkt size %d\n", obu_size, rem_pkt_size); return AVERROR_INVALIDDATA; @@ -240,6 +238,8 @@ static int av1_handle_packet(AVFormatContext *ctx, PayloadContext *data, return AVERROR_INVALIDDATA; } + // read first byte (which is the header byte only for non-fragmented elements) + obu_hdr = *buf_ptr; if (!is_frag_cont) { uint8_t obu_type = (obu_hdr >> AV1S_OBU_TYPE) & AV1M_OBU_TYPE; if (obu_hdr & AV1F_OBU_FORBIDDEN) { -- 2.52.0 >From cf1864549f054e4cd81e5d900552c2d3d545e2d4 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:22:46 +0200 Subject: [PATCH 5/7] avformat/rdt: Check the size of the AAC data left in the packet The check was suggested in the report. Hardening for JRU5LF4QdVjc (AISLE-2026-0111-00165) Found-by: Joshua Rogers <[email protected]> --- libavformat/rdt.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/rdt.c b/libavformat/rdt.c index 77048d59c8..2f45b5fa15 100644 --- a/libavformat/rdt.c +++ b/libavformat/rdt.c @@ -314,6 +314,8 @@ rdt_parse_packet (AVFormatContext *ctx, PayloadContext *rdt, AVStream *st, return res; if (res > 0) { if (st->codecpar->codec_id == AV_CODEC_ID_AAC) { + if (len - pos > sizeof(rdt->buffer)) + return AVERROR_INVALIDDATA; memcpy (rdt->buffer, buf + pos, len - pos); rdt->rmctx->pb = avio_alloc_context (rdt->buffer, len - pos, 0, NULL, NULL, NULL, NULL); -- 2.52.0 >From 5d52c82954202e946af64ddbb0d7b70f09d96fa8 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:22:54 +0200 Subject: [PATCH 6/7] doc/protocols: State that the shared cache directories must be trusted Documenting that the directories must not be writable by untrusted users was suggested in the report. Documentation for umsIH5gcyBXl (AISLE-2026-0111-00168) Found-by: Joshua Rogers <[email protected]> --- doc/protocols.texi | 3 +++ 1 file changed, 3 insertions(+) diff --git a/doc/protocols.texi b/doc/protocols.texi index dbb1f166c7..74217103e3 100644 --- a/doc/protocols.texi +++ b/doc/protocols.texi @@ -1747,6 +1747,9 @@ The accepted options are: @item cache_dir Path to the directory where cache files are stored. This option is required. +Anyone who can write to this directory or to @option{metadata_dir} can alter +the data read by all users of the cache, or make them crash, so neither may be +writable by untrusted users. @item metadata_dir Path to the directory where metadata files are stored. Optional. If not -- 2.52.0 >From 06d855b1cdeb719f71a74ca5b669602975bc4126 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:22:54 +0200 Subject: [PATCH 7/7] doc/protocols: State that the shared cache key ignores request options Documenting this was suggested in the report. Documentation for oSnACc1DZtVF (AISLE-2026-0111-00167) Found-by: Joshua Rogers <[email protected]> --- doc/protocols.texi | 3 +++ 1 file changed, 3 insertions(+) diff --git a/doc/protocols.texi b/doc/protocols.texi index 74217103e3..d632466ac7 100644 --- a/doc/protocols.texi +++ b/doc/protocols.texi @@ -1741,6 +1741,9 @@ some risk of collision if the same URL is used for different content (e.g. as a result of extra POST data being used to select the stream ID). To avoid this, make sure to only use this protocol for URLs that uniquely identify the content; otherwise you may get a garbled mix of sources. +This includes content selected by request options such as headers, cookies or +credentials: data cached for one user is returned to every other user of the +same cache directory. The accepted options are: @table @option -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
