This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 5993347a1b avformat/flvenc: reject text packets too long for an AMF0
string
5993347a1b is described below
commit 5993347a1b84a88892ac66a8ef981f7f18e9997c
Author: Martin Mirchev <[email protected]>
AuthorDate: Sun Oct 18 17:24:07 2026 +0800
Commit: michaelni <[email protected]>
CommitDate: Mon Oct 19 19:33:13 2026 +0000
avformat/flvenc: reject text packets too long for an AMF0 string
AV_CODEC_ID_TEXT packets are written as an AMF0 string, whose length is a
16-bit field. For text over 65535 bytes the length wrapped (e.g. 4464 for
70000 bytes) while the whole text was written, so readers misparse the
onTextData tag.
Fail on such packets before writing the tag.
Found while reviewing the metadata length fix for FLV.
Signed-off-by: Martin Mirchev <[email protected]>
---
libavformat/flvenc.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavformat/flvenc.c b/libavformat/flvenc.c
index 7c8d0a126b..2febb96d05 100644
--- a/libavformat/flvenc.c
+++ b/libavformat/flvenc.c
@@ -1280,6 +1280,12 @@ static int flv_write_packet(AVFormatContext *s, AVPacket
*pkt)
return AVERROR(EINVAL);
}
}
+ /* the text is written as an AMF0 string with a 16-bit length */
+ if (par->codec_id == AV_CODEC_ID_TEXT &&
+ strlen((const char *)pkt->data) > UINT16_MAX) {
+ av_log(s, AV_LOG_ERROR, "Text packet is too long for FLV\n");
+ return AVERROR(EINVAL);
+ }
ts = pkt->dts;
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
