PR #24943 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24943 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24943.patch
Found-by: zhang xingxing <[email protected]> Found-by: Joshua Rogers <[email protected]> >From db72b7b8fd533cacf5bbd63fafdb763ec6f5e6b1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 8 Oct 2026 01:53:17 +0200 Subject: [PATCH 1/5] avformat/mpegtsenc: Do not copy extradata that does not exist For streams without extradata memcpy() was called with a NULL source. Fixes: 5M151mE1kuw5 memcpy() from NULL Replicated through UnModified FFmpeg with UBSAN Found while testing the fix for the security report AISLE-2026-0111-00391 --- libavformat/mpegtsenc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/mpegtsenc.c b/libavformat/mpegtsenc.c index c7733f65e3..8ea1afef4e 100644 --- a/libavformat/mpegtsenc.c +++ b/libavformat/mpegtsenc.c @@ -1902,7 +1902,8 @@ static uint8_t *h26x_prefix_aud(const uint8_t *aud, const int aud_size, return NULL; AV_WB32(data, 0x00000001); memcpy(data + sz, aud, aud_size); - memcpy(data + sz + aud_size, extra_data, extra_size); + if (extra_size) + memcpy(data + sz + aud_size, extra_data, extra_size); memcpy(data + sz + aud_size + extra_size, pkt->data, pkt->size); *size = pkt->size + sz + aud_size + extra_size; return data; -- 2.52.0 >From 6ebfda4ebc41ca64e5cbf3552b4a69d94be8d7eb Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:31:55 +0200 Subject: [PATCH 2/5] avformat/movenc: Reject AVIF output with any non-video stream The check only failed when both streams were not video, a single non-video stream or a non-video second stream were accepted. Fixes: ugZ9hTL5EWJM Missing stream type check Replicated through UnModified FFmpeg Found during triage of the security report UwVT8CSrU4Oh --- libavformat/movenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 6492f4ffb3..ec8620033c 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -8396,7 +8396,7 @@ static int mov_init(AVFormatContext *s) av_log(s, AV_LOG_ERROR, "AVIF output requires exactly one or two streams\n"); return AVERROR(EINVAL); } - if (s->streams[0]->codecpar->codec_type != AVMEDIA_TYPE_VIDEO && + if (s->streams[0]->codecpar->codec_type != AVMEDIA_TYPE_VIDEO || (s->nb_streams > 1 && s->streams[1]->codecpar->codec_type != AVMEDIA_TYPE_VIDEO)) { av_log(s, AV_LOG_ERROR, "AVIF output supports only video streams\n"); return AVERROR(EINVAL); -- 2.52.0 >From 062fddf3ff209239a5b6aec4d04b6f08de751d77 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 00:04:32 +0200 Subject: [PATCH 3/5] avformat/rmenc: Do not write a byte past odd sized AC-3 packets Not a security issue. Wrong packet framing Replicated through UnModified FFmpeg Found-by: zhang xingxing <[email protected]> Found-by: Joshua Rogers <[email protected]> Suggested-by: zhang xingxing <[email protected]> --- libavformat/rmenc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/rmenc.c b/libavformat/rmenc.c index faa6cb9bdc..c97cbb7239 100644 --- a/libavformat/rmenc.c +++ b/libavformat/rmenc.c @@ -374,10 +374,12 @@ static int rm_write_audio(AVFormatContext *s, const uint8_t *buf, int size, int if (stream->par->codec_id == AV_CODEC_ID_AC3) { /* for AC-3, the words seem to be reversed */ - for (i = 0; i < size; i += 2) { + for (i = 0; i < size - 1; i += 2) { avio_w8(pb, buf[i + 1]); avio_w8(pb, buf[i]); } + if (size & 1) + avio_w8(pb, buf[size - 1]); } else { avio_write(pb, buf, size); } -- 2.52.0 >From c883f5edee6d7c56438be21e0dd163443b9b2e2b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 00:05:29 +0200 Subject: [PATCH 4/5] avformat/wavenc: Keep the peak envelope channel index across packets The channel index restarted at 0 for every packet, so after a packet that ended inside a sample frame the following samples were counted for the wrong channels. Wrong peak values Replicated through UnModified FFmpeg Found during triage of the security report LHiad3FmdAmI --- libavformat/wavenc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/wavenc.c b/libavformat/wavenc.c index c9ced4a1bd..1056d437d1 100644 --- a/libavformat/wavenc.c +++ b/libavformat/wavenc.c @@ -86,6 +86,7 @@ typedef struct WAVMuxContext { int peak_block_size; int peak_format; int peak_block_pos; + int peak_channel; int peak_ppv; int peak_bps; } WAVMuxContext; @@ -403,7 +404,7 @@ static int wav_write_packet(AVFormatContext *s, AVPacket *pkt) avio_write(pb, pkt->data, pkt->size); if (wav->write_peak) { - int c = 0; + int c = wav->peak_channel; int i; for (i = 0; i < pkt->size; i += wav->peak_bps) { if (wav->peak_bps == 1) { @@ -423,6 +424,7 @@ static int wav_write_packet(AVFormatContext *s, AVPacket *pkt) } } } + wav->peak_channel = c; } if(pkt->pts != AV_NOPTS_VALUE) { -- 2.52.0 >From 4c168719fd4d1ee53275c07a9cc54fad54e2220f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 00:05:30 +0200 Subject: [PATCH 5/5] avformat/wavenc: Reject streams without channels A WAV file needs at least one channel; a stream without channels was written with a channel count of 0. Invalid output Replicated through UnModified FFmpeg Found during triage of the security report LHiad3FmdAmI --- libavformat/wavenc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/wavenc.c b/libavformat/wavenc.c index 1056d437d1..ab0bf19f4f 100644 --- a/libavformat/wavenc.c +++ b/libavformat/wavenc.c @@ -150,6 +150,11 @@ static av_cold int wav_init(AVFormatContext *s) { WAVMuxContext *wav = s->priv_data; + if (s->streams[0]->codecpar->ch_layout.nb_channels <= 0) { + av_log(s, AV_LOG_ERROR, "Invalid number of channels\n"); + return AVERROR(EINVAL); + } + if (wav->write_peak == PEAK_ONLY) { if (wav->rf64 == RF64_ALWAYS) { av_log(s, AV_LOG_ERROR, "write_peak=only is not compatible with RF64\n"); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
