This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/6.1 in repository ffmpeg.
commit cc853322ac5f881e03057aff7ac2e903848f4184 Author: Michael Niedermayer <[email protected]> AuthorDate: Fri Jan 23 15:28:58 2026 +0100 Commit: Michael Niedermayer <[email protected]> CommitDate: Mon May 4 17:13:17 2026 +0200 avformat/mpegtsenc: Check remaining space in SDT Fixes: out of array access Fixes: VULN-8 Found-by: Zhenpeng (Leo) Lin from depthfirst Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 19c78cd6d90f025657348c28e9562e4e1bda3802) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mpegtsenc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavformat/mpegtsenc.c b/libavformat/mpegtsenc.c index 84edd418f0..84ed8c5ed7 100644 --- a/libavformat/mpegtsenc.c +++ b/libavformat/mpegtsenc.c @@ -54,6 +54,7 @@ typedef struct MpegTSSection { int discontinuity; void (*write_packet)(struct MpegTSSection *s, const uint8_t *packet); void *opaque; + int remaining; } MpegTSSection; typedef struct MpegTSService { @@ -1010,6 +1011,10 @@ static MpegTSService *mpegts_add_service(AVFormatContext *s, int sid, av_log(s, AV_LOG_ERROR, "Too long service or provider name\n"); goto fail; } + ts->sdt.remaining -= 10 + service->provider_name[0] + service->name[0]; + if (ts->sdt.remaining < 0) + goto fail; + if (av_dynarray_add_nofree(&ts->services, &ts->nb_services, service) < 0) goto fail; @@ -1120,6 +1125,8 @@ static int mpegts_init(AVFormatContext *s) // round up to a whole number of TS packets ts->pes_payload_size = (ts->pes_payload_size + 14 + 183) / 184 * 184 - 14; + ts->sdt.remaining = SECTION_LENGTH - 3; + if (!s->nb_programs) { /* allocate a single DVB service */ if (!mpegts_add_service(s, ts->service_id, s->metadata, NULL)) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
