PR #25176 opened by Marti2203 URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25176 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25176.patch
Follow-up to #25169, from its review. For `AV_CODEC_ID_TEXT` packets, `flv_write_packet()` writes the text as an AMF0 string, whose length is a 16-bit field. Text over 65535 bytes wraps the length while the whole text is written, e.g. with SRT subtitles converted with `-c:s text`, a 70017-byte cue is declared as 4481 bytes and a 65536-byte one as 1, so the onTextData tag is misparsed (the enclosing tag size is correct, so later tags are not affected). flvdec only reads the short string type here, so writing an AMF0 long string instead would not round-trip; with the patch such packets are rejected with "Text packet is too long for FLV" before any of the tag is written. Text of exactly 65535 bytes is written as before. FATE `lavf-flv` and `seek-lavf-flv` pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01PJjAkXVedLvPoWWc6fokZ3 From 728d95403498973045dac7cb23c017fb386a2973 Mon Sep 17 00:00:00 2001 From: Martin Mirchev <[email protected]> Date: Sun, 18 Oct 2026 17:24:07 +0800 Subject: [PATCH] avformat/flvenc: reject text packets too long for an AMF0 string AV_CODEC_ID_TEXT packets are written as an AMF0 string, whose length is a 16-bit field. For text over 65535 bytes the length wrapped (e.g. 4464 for 70000 bytes) while the whole text was written, so readers misparse the onTextData tag. Fail on such packets before writing the tag. Found while reviewing the metadata length fix for FLV. Signed-off-by: Martin Mirchev <[email protected]> --- libavformat/flvenc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/flvenc.c b/libavformat/flvenc.c index 7c8d0a126b..2febb96d05 100644 --- a/libavformat/flvenc.c +++ b/libavformat/flvenc.c @@ -1280,6 +1280,12 @@ static int flv_write_packet(AVFormatContext *s, AVPacket *pkt) return AVERROR(EINVAL); } } + /* the text is written as an AMF0 string with a 16-bit length */ + if (par->codec_id == AV_CODEC_ID_TEXT && + strlen((const char *)pkt->data) > UINT16_MAX) { + av_log(s, AV_LOG_ERROR, "Text packet is too long for FLV\n"); + return AVERROR(EINVAL); + } ts = pkt->dts; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
