This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 19c78cd6d9 avformat/mpegtsenc: Check remaining space in SDT
19c78cd6d9 is described below
commit 19c78cd6d90f025657348c28e9562e4e1bda3802
Author: Michael Niedermayer <[email protected]>
AuthorDate: Fri Jan 23 15:28:58 2026 +0100
Commit: Michael Niedermayer <[email protected]>
CommitDate: Tue Feb 10 01:07:19 2026 +0100
avformat/mpegtsenc: Check remaining space in SDT
Fixes: out of array access
Fixes: VULN-8
Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/mpegtsenc.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/libavformat/mpegtsenc.c b/libavformat/mpegtsenc.c
index ea7c6065a0..96cdea955e 100644
--- a/libavformat/mpegtsenc.c
+++ b/libavformat/mpegtsenc.c
@@ -57,6 +57,7 @@ typedef struct MpegTSSection {
int discontinuity;
void (*write_packet)(struct MpegTSSection *s, const uint8_t *packet);
void *opaque;
+ int remaining;
} MpegTSSection;
typedef struct MpegTSService {
@@ -1018,6 +1019,10 @@ static MpegTSService *mpegts_add_service(AVFormatContext
*s, int sid,
av_log(s, AV_LOG_ERROR, "Too long service or provider name\n");
goto fail;
}
+ ts->sdt.remaining -= 10 + service->provider_name[0] + service->name[0];
+ if (ts->sdt.remaining < 0)
+ goto fail;
+
if (av_dynarray_add_nofree(&ts->services, &ts->nb_services, service) < 0)
goto fail;
@@ -1128,6 +1133,8 @@ static int mpegts_init(AVFormatContext *s)
// round up to a whole number of TS packets
ts->pes_payload_size = (ts->pes_payload_size + 14 + 183) / 184 * 184 - 14;
+ ts->sdt.remaining = SECTION_LENGTH - 3;
+
if (!s->nb_programs) {
/* allocate a single DVB service */
if (!mpegts_add_service(s, ts->service_id, s->metadata, NULL))
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
