PR #24948 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24948 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24948.patch
Found during triage of the security reports >From 49c1803331a11de3029ee8e604c9b0f0174ee105 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:54:53 +0200 Subject: [PATCH 1/2] avformat/mxfenc: Fail on invalid FFV1 versions instead of asserting Fixes: assertion failure Fixes: NwEesUvc9OLL Assertion failure Replicated through UnModified FFmpeg Assertion failure on extradata Replicated through API Found during triage of the security report AISLE-2026-0111-00534 --- libavformat/mxfenc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavformat/mxfenc.c b/libavformat/mxfenc.c index 48043a7d47..ba889e60de 100644 --- a/libavformat/mxfenc.c +++ b/libavformat/mxfenc.c @@ -2676,8 +2676,7 @@ static int mxf_parse_ffv1_frame(AVFormatContext *s, AVStream *st, AVPacket *pkt) ff_init_range_decoder(&c, st->codecpar->extradata, st->codecpar->extradata_size); ff_build_rac_states(&c, 0.05 * (1LL << 32), 256 - 8); v = get_ffv1_unsigned_symbol(&c, state); - av_assert0(v >= 2); - if (v > 4) { + if (v < 2 || v > 4) { av_log(s, AV_LOG_ERROR, "unsupported ffv1 version %d\n", v); return 0; } @@ -2688,7 +2687,8 @@ static int mxf_parse_ffv1_frame(AVFormatContext *s, AVStream *st, AVPacket *pkt) ff_build_rac_states(&c, 0.05 * (1LL << 32), 256 - 8); get_rac(&c, &keystate); // keyframe v = get_ffv1_unsigned_symbol(&c, state); - av_assert0(v < 2); + if (v >= 2) + return 0; } sc->codec_ul = &mxf_ffv1_codec_uls[v]; sc->sub_descriptor = FFV1SubDescriptor; -- 2.52.0 >From f5201dde1bafdd7eb91bc537006e3d4914ca75a2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 6 Oct 2026 23:38:45 +0200 Subject: [PATCH 2/2] avformat/mxfenc: Reject D-10 audio with more than 8 channels The D-10 AES3 element has 8 channels (SMPTE 386M). Fixes: invalid shift Fixes: dAUa8TJu8sCA Invalid shift Replicated through UnModified FFmpeg with UBSAN Found during triage of the security report jQbdKiuH8zFh --- libavformat/mxfenc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/mxfenc.c b/libavformat/mxfenc.c index ba889e60de..ca6e611fe3 100644 --- a/libavformat/mxfenc.c +++ b/libavformat/mxfenc.c @@ -3049,6 +3049,10 @@ static int mxf_init(AVFormatContext *s) st->codecpar->codec_id != AV_CODEC_ID_PCM_S24LE) { av_log(s, AV_LOG_ERROR, "MXF D-10 only support 16 or 24 bits le audio\n"); } + if (st->codecpar->ch_layout.nb_channels > 8) { + av_log(s, AV_LOG_ERROR, "MXF D-10 supports at most 8 audio channels\n"); + return AVERROR(EINVAL); + } sc->index = INDEX_D10_AUDIO; sc->container_ul = ((MXFStreamContext*)s->streams[0]->priv_data)->container_ul; sc->frame_size = 4 + 8 * av_rescale_rnd(st->codecpar->sample_rate, mxf->time_base.num, mxf->time_base.den, AV_ROUND_UP) * 4; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
