PR #24357 opened by yqtian-se URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24357 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24357.patch
This fixes an out-of-bounds read in the metadata filter print path. When vsnprintf() truncated output, its return value could exceed the 128-byte stack buffer but was still passed to avio_write(). The change uses avio_vprintf() so the complete formatted value is written without the fixed intermediate buffer.\n\nA 400-byte metadata value reproduced a 406-byte AddressSanitizer read before the change. After the change, the output matches the complete value. The commit-message check passes and 257 FATE tests completed without failure. >From 3948fe465aa0a45cb59f8d00b620d000a973641b Mon Sep 17 00:00:00 2001 From: Yongqiang Tian <[email protected]> Date: Thu, 3 Sep 2026 12:09:55 +0000 Subject: [PATCH] avfilter/f_metadata: avoid overread on long formatted output vsnprintf() returns the number of characters that would have been written when its output is truncated. Passing that value to avio_write() makes it read beyond the 128-byte stack buffer for long metadata values. Use avio_vprintf() to write the complete formatted string without the fixed intermediate buffer. Fixes: b0159af6bc76553b1ab7546d821bb8c16a666cfd Signed-off-by: Yongqiang Tian <[email protected]> --- libavfilter/f_metadata.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/libavfilter/f_metadata.c b/libavfilter/f_metadata.c index a9036ab475..c2e0a50e13 100644 --- a/libavfilter/f_metadata.c +++ b/libavfilter/f_metadata.c @@ -199,11 +199,8 @@ static void print_file(AVFilterContext *ctx, const char *msg, ...) va_list argument_list; va_start(argument_list, msg); - if (msg) { - char buf[128]; - int ret = vsnprintf(buf, sizeof(buf), msg, argument_list); - avio_write(s->avio_context, buf, ret); - } + if (msg) + avio_vprintf(s->avio_context, msg, argument_list); va_end(argument_list); } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
