This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 58d39e99e2 avformat/concatdec: Check recursion depth
58d39e99e2 is described below
commit 58d39e99e26d1116f43a67d66ecfe71dba316875
Author: Michael Niedermayer <[email protected]>
AuthorDate: Mon Jul 7 02:53:18 2025 +0200
Commit: Michael Niedermayer <[email protected]>
CommitDate: Tue Jul 14 04:52:18 2026 +0200
avformat/concatdec: Check recursion depth
This variant is easy backportable but is concatdec specific
Fixes: self_ref.ffconcat
Reported-by: Yuhao Jiang <[email protected]>
Rediscovered-by: Anxious Koisi
Fixes: RWHkT0ASFMNI
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/concatdec.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/libavformat/concatdec.c b/libavformat/concatdec.c
index c57d1b649a..665b4e3e66 100644
--- a/libavformat/concatdec.c
+++ b/libavformat/concatdec.c
@@ -73,6 +73,7 @@ typedef struct {
ConcatMatchMode stream_match_mode;
unsigned auto_convert;
int segment_time_metadata;
+ int recursion_depth;
} ConcatContext;
static int concat_probe(const AVProbeData *probe)
@@ -357,6 +358,12 @@ static int open_file(AVFormatContext *avf, unsigned fileno)
if (ret < 0)
return ret;
+ ret = av_dict_set_int(&options, "recursion_depth", cat->recursion_depth -
1, 0);
+ if (ret < 0) {
+ av_dict_free(&options);
+ return ret;
+ }
+
if ((ret = avformat_open_input(&cat->avf, file->url, NULL, &options)) < 0
||
(ret = avformat_find_stream_info(cat->avf, NULL)) < 0) {
av_log(avf, AV_LOG_ERROR, "Impossible to open '%s'\n", file->url);
@@ -364,6 +371,7 @@ static int open_file(AVFormatContext *avf, unsigned fileno)
avformat_close_input(&cat->avf);
return ret;
}
+ av_dict_set(&options, "recursion_depth", NULL, 0);
if (options) {
av_log(avf, AV_LOG_WARNING, "Unused options for '%s'.\n", file->url);
/* TODO log unused options once we have a proper string API */
@@ -665,6 +673,11 @@ static int concat_read_header(AVFormatContext *avf)
unsigned i;
int ret;
+ if (cat->recursion_depth <= 0) {
+ av_log(avf, AV_LOG_ERROR, "Too deep recursion\n");
+ return AVERROR_INVALIDDATA;
+ }
+
ret = concat_parse_script(avf);
if (ret < 0)
return ret;
@@ -940,6 +953,8 @@ static const AVOption options[] = {
OFFSET(auto_convert), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, DEC },
{ "segment_time_metadata", "output file segment start time and duration as
packet metadata",
OFFSET(segment_time_metadata), AV_OPT_TYPE_BOOL, {.i64 = 0}, 0, 1, DEC },
+ { "recursion_depth", "max recursion depth",
+ OFFSET(recursion_depth), AV_OPT_TYPE_INT, {.i64 = 10}, 0, INT_MAX, DEC },
{ NULL }
};
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
