PR #25033 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25033 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25033.patch
Found-by: zhang xingxing <[email protected]> >From 8f3f36fec9a0fe1827caaa80bd50952de0ddfb88 Mon Sep 17 00:00:00 2001 From: zhang xingxing <[email protected]> Date: Sat, 10 Oct 2026 08:31:03 +0200 Subject: [PATCH 1/4] avformat/iamf_reader: fix the inverted subblock duration check This is not a security issue. Regression since: 8665748584 Fixes: usWfwH9F2jUN Fixes: swarm-Inverted-comparison-in-subblock_duration-validation-6190ea Found-by: zhang xingxing <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/iamf_reader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/iamf_reader.c b/libavformat/iamf_reader.c index 1b963ee311..c2375ea835 100644 --- a/libavformat/iamf_reader.c +++ b/libavformat/iamf_reader.c @@ -201,7 +201,7 @@ static int parameter_block_obu(AVFormatContext *s, IAMFDemuxContext *c, if (!param_definition->mode && !constant_subblock_duration) { subblock_duration = ffio_read_leb(pb); - if (duration - total_duration > subblock_duration) { + if (subblock_duration > duration - total_duration) { av_log(s, AV_LOG_ERROR, "Invalid subblock durations in parameter_id %u\n", parameter_id); ret = AVERROR_INVALIDDATA; goto fail; -- 2.52.0 >From 7093ac8e4e3fe75602de9f1c6a5a15a4135d859e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 10 Oct 2026 08:33:13 +0200 Subject: [PATCH 2/4] avformat/vqf: reject more than two channels Fixes: Timeout Fixes: xYsvVfSX7ZHq Fixes: swarm-Integer-overflow-in-VQF-frame_bit_len-computation-3a8153 Found-by: zhang xingxing <[email protected]> Suggested-by: zhang xingxing <[email protected]> Infinite loop Replicated through UnModified FFmpeg with timeout Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/vqf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/vqf.c b/libavformat/vqf.c index fb668c16da..a83b59bcdd 100644 --- a/libavformat/vqf.c +++ b/libavformat/vqf.c @@ -152,7 +152,7 @@ static int vqf_read_header(AVFormatContext *s) rate_flag = AV_RB32(comm_chunk + 8); avio_skip(s->pb, len-12); - if (st->codecpar->ch_layout.nb_channels <= 0) { + if (st->codecpar->ch_layout.nb_channels <= 0 || st->codecpar->ch_layout.nb_channels > 2) { av_log(s, AV_LOG_ERROR, "Invalid number of channels\n"); return AVERROR_INVALIDDATA; } -- 2.52.0 >From 60b78387814c623a0db8b05836e74014491d015c Mon Sep 17 00:00:00 2001 From: zhang xingxing <[email protected]> Date: Sat, 10 Oct 2026 08:33:13 +0200 Subject: [PATCH 3/4] avformat/realtextdec: keep the window duration in 64 bits This is not a security issue. Fixes: GJrBZmxJqqm8 Fixes: swarm-Integer-truncation-of-parsed-duration-and-timestamps-1a4b12 Found-by: zhang xingxing <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/realtextdec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/realtextdec.c b/libavformat/realtextdec.c index 31f2263341..8f77939210 100644 --- a/libavformat/realtextdec.c +++ b/libavformat/realtextdec.c @@ -64,7 +64,8 @@ static int realtext_read_header(AVFormatContext *s) AVStream *st = avformat_new_stream(s, NULL); AVBPrint buf; char c = 0; - int res = 0, duration = read_ts("60"); // default duration is 60 seconds + int res = 0; + int64_t duration = read_ts("60"); // default duration is 60 seconds FFTextReader tr; ff_text_init_avio(s, &tr, s->pb); -- 2.52.0 >From 7f29a2d9fbb1ce6138cc4941883166537c2f276b Mon Sep 17 00:00:00 2001 From: zhang xingxing <[email protected]> Date: Sat, 10 Oct 2026 08:33:56 +0200 Subject: [PATCH 4/4] avformat/file: release the JNI references when fstat() fails in android_content_open() This is not a security issue. Fixes: yehJZZYu2sOZ Fixes: swarm-JNI-resource-leak-on-fstat-failure-in-android_content_open-e505e3 Found-by: zhang xingxing <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/file.c b/libavformat/file.c index bb99198a6a..b52675becd 100644 --- a/libavformat/file.c +++ b/libavformat/file.c @@ -740,8 +740,9 @@ static int android_content_open(URLContext *h, const char *filename, int flags) goto done; if (fstat(fd, &st) < 0) { + ret = AVERROR(errno); close(fd); - return AVERROR(errno); + goto done; } c->fd = fd; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
