PR #24942 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24942 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24942.patch
Found during triage of the security report AISLE-2026-0111-00173 >From 036c40e07694058e5744df42d8ca06b27b256187 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 00:07:48 +0200 Subject: [PATCH 1/4] avformat/nutenc: Do not write IAMF parameter side data Fixes: address disclosure Fixes: bH0O2TMvkU1D Address disclosure Replicated through UnModified FFmpeg Found during triage of the security report AISLE-2026-0111-00173 --- libavformat/nutenc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/nutenc.c b/libavformat/nutenc.c index 55efb114c3..caf84b84d8 100644 --- a/libavformat/nutenc.c +++ b/libavformat/nutenc.c @@ -947,6 +947,10 @@ static int write_sm_data(AVFormatContext *s, AVIOContext *bc, AVPacket *pkt, int case AV_PKT_DATA_QUALITY_STATS: // belongs into meta, not side data break; + case AV_PKT_DATA_IAMF_MIX_GAIN_PARAM: + case AV_PKT_DATA_IAMF_DEMIXING_INFO_PARAM: + case AV_PKT_DATA_IAMF_RECON_GAIN_INFO_PARAM: + break; } } } -- 2.52.0 >From 4ef5693eff76cff3576d7a95cfa46937ef743bbc Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 00:08:31 +0200 Subject: [PATCH 2/4] avformat/hashenc: Do not hash IAMF parameter side data Fixes: address dependent output Fixes: bH0O2TMvkU1D Address dependent hash Replicated through UnModified FFmpeg Found during triage of the security report AISLE-2026-0111-00173 --- libavformat/hashenc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/hashenc.c b/libavformat/hashenc.c index 0cb7c6147d..095f1b3073 100644 --- a/libavformat/hashenc.c +++ b/libavformat/hashenc.c @@ -130,7 +130,9 @@ static void hash_print_sidedata(struct AVFormatContext *s, uint32_t data = AV_RL32(sd[i].data + j); av_hash_update(c->hashes->hash, (uint8_t *)&data, sizeof(uint32_t)); } - } else + } else if (sd[i].type != AV_PKT_DATA_IAMF_MIX_GAIN_PARAM && + sd[i].type != AV_PKT_DATA_IAMF_DEMIXING_INFO_PARAM && + sd[i].type != AV_PKT_DATA_IAMF_RECON_GAIN_INFO_PARAM) av_hash_update(c->hashes->hash, sd[i].data, sd[i].size); snprintf(buf, sizeof(buf) - (AV_HASH_MAX_SIZE * 2 + 1), ", %8zu, ", sd[i].size); -- 2.52.0 >From 97915a761b662cc8668099029b2b73ff0e7c1fbb Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 00:10:02 +0200 Subject: [PATCH 3/4] avformat/nutenc: Do not write the BlockAddID as part of CodecSpecificSide The BlockAddID is already in the CodecSpecificSide name, nutdec adds it to the side data again, so each remux through NUT added 8 bytes. Fixes: c0A4sxdoEpO2 BlockAdditional growing by 8 bytes Replicated through UnModified FFmpeg Found during triage of the security report AISLE-2026-0111-00173 --- libavformat/nutenc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavformat/nutenc.c b/libavformat/nutenc.c index caf84b84d8..d1540ca035 100644 --- a/libavformat/nutenc.c +++ b/libavformat/nutenc.c @@ -903,6 +903,8 @@ static int write_sm_data(AVFormatContext *s, AVIOContext *bc, AVPacket *pkt, int } else if(pkt->side_data[i].type == AV_PKT_DATA_MATROSKA_BLOCKADDITIONAL) { snprintf(tmp, sizeof(tmp), "CodecSpecificSide%"PRId64"", AV_RB64(data)); put_str(dyn_bc, tmp); + data += 8; + size -= 8; } else { snprintf(tmp, sizeof(tmp), "UserData%s-SD-%d", (s->flags & AVFMT_FLAG_BITEXACT) ? "Lavf" : LIBAVFORMAT_IDENT, @@ -911,8 +913,8 @@ static int write_sm_data(AVFormatContext *s, AVIOContext *bc, AVPacket *pkt, int } put_s(dyn_bc, -2); put_str(dyn_bc, "bin"); - put_v(dyn_bc, pkt->side_data[i].size); - avio_write(dyn_bc, data, pkt->side_data[i].size); + put_v(dyn_bc, size); + avio_write(dyn_bc, data, size); sm_data_count++; break; case AV_PKT_DATA_PARAM_CHANGE: -- 2.52.0 >From 68fdc45cbb220c0f15c5c50d95bd98b510d77849 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 8 Oct 2026 01:55:36 +0200 Subject: [PATCH 4/4] avformat/nut: Store the side data palette in little endian Fixes: xzy7SwiePKkh Wrong palette Replicated through UnModified FFmpeg on s390x (qemu) Found while testing the fixes for the security report AISLE-2026-0111-00173 --- libavformat/nutdec.c | 3 +++ libavformat/nutenc.c | 7 ++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c index b0a997cad6..a23f8814cd 100644 --- a/libavformat/nutdec.c +++ b/libavformat/nutdec.c @@ -939,6 +939,9 @@ static int read_sm_data(AVFormatContext *s, AVIOContext *bc, AVPacket *pkt, int if(!dst) return AVERROR(ENOMEM); avio_read(bc, dst, value_len); + if (HAVE_BIGENDIAN && !strcmp(name, "Palette")) + for (int j = 0; j + 4 <= value_len; j += 4) + AV_WN32(dst + j, AV_RL32(dst + j)); } else if (value == -3) { value = get_s(bc); } else if (value == -4) { diff --git a/libavformat/nutenc.c b/libavformat/nutenc.c index d1540ca035..15b22e6572 100644 --- a/libavformat/nutenc.c +++ b/libavformat/nutenc.c @@ -914,7 +914,12 @@ static int write_sm_data(AVFormatContext *s, AVIOContext *bc, AVPacket *pkt, int put_s(dyn_bc, -2); put_str(dyn_bc, "bin"); put_v(dyn_bc, size); - avio_write(dyn_bc, data, size); + if (HAVE_BIGENDIAN && pkt->side_data[i].type == AV_PKT_DATA_PALETTE) { + for (int j = 0; j + 4 <= size; j += 4) + avio_wl32(dyn_bc, AV_RN32(data + j)); + avio_write(dyn_bc, data + (size & ~3), size & 3); + } else + avio_write(dyn_bc, data, size); sm_data_count++; break; case AV_PKT_DATA_PARAM_CHANGE: -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
