PR #25464 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25464 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25464.patch
had&have grok bot compute and nothing to do with it so asked it to audit FFmpeg, thats the result >From 923d72e4a60708a6b8c87d3c85e577efe5e8b89e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 26 Oct 2026 01:12:01 +0100 Subject: [PATCH 1/3] avformat/mvrdec: drop AVFMT_GENERIC_INDEX Seeking only needs the index entries, not the flag. Re-read failure Replicated through UnModified FFmpeg with ASAN Found by a grok bot based audit of the code --- libavformat/mvrdec.c | 1 - 1 file changed, 1 deletion(-) diff --git a/libavformat/mvrdec.c b/libavformat/mvrdec.c index ab594dd1e73..fe27f08f9bd 100644 --- a/libavformat/mvrdec.c +++ b/libavformat/mvrdec.c @@ -200,7 +200,6 @@ const FFInputFormat ff_mvr_demuxer = { .p.name = "mvr", .p.long_name = NULL_IF_CONFIG_SMALL("MVR CCTV"), .p.extensions = "mvr", - .p.flags = AVFMT_GENERIC_INDEX, .priv_data_size = sizeof(MVRContext), .read_probe = mvr_probe, .read_header = mvr_read_header, -- 2.54.0 >From 14c986f3517742e4c14bbf916c8f059c55d6ed49 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 26 Oct 2026 01:12:01 +0100 Subject: [PATCH 2/3] avformat/mov: fix leak of the gain map parameters when the tmap payload allocation fails The payload size is the item's extent length from the file, so the allocation can fail for a crafted file. Leak Replicated through UnModified FFmpeg with LSAN Found by a grok bot based audit of the code. --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index e2f33643f78..a277e7cfc3d 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -11656,7 +11656,7 @@ static int mov_parse_heif_layered_video_tmap(AVFormatContext *s, const HEIFGroup payload = av_malloc(tmap->item->extent_length); if (!payload) { - return AVERROR(ENOMEM); + err = AVERROR(ENOMEM); goto fail; } -- 2.54.0 >From 95fbe32c1a34bd5d3c12069e5cd7d71a830d72a8 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 26 Oct 2026 01:12:01 +0100 Subject: [PATCH 3/3] avcodec/bsf/dovi_split: reject NAL units that do not fit the output length field Truncated length field Replicated through UnModified FFmpeg Found by a grok bot based audit of the code. --- libavcodec/bsf/dovi_split.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavcodec/bsf/dovi_split.c b/libavcodec/bsf/dovi_split.c index dd58b798ee1..5d7c44f12bd 100644 --- a/libavcodec/bsf/dovi_split.c +++ b/libavcodec/bsf/dovi_split.c @@ -193,6 +193,13 @@ static int dovi_split_filter(AVBSFContext *ctx, AVPacket *out) int payload_size; if (!nal_is_kept(s, &s->pkt.nals[i], &payload, &payload_size)) continue; + if (s->out_nal_length_size && s->out_nal_length_size < 4 && + payload_size >= 1 << (8 * s->out_nal_length_size)) { + av_log(ctx, AV_LOG_ERROR, "NAL unit size %d does not fit in %d bytes\n", + payload_size, s->out_nal_length_size); + ret = AVERROR_INVALIDDATA; + goto fail; + } out_size += prefix_size + payload_size; kept_count++; } -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
