PR #24518 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24518 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24518.patch
Fixes: heap buffer overflow (read) Fixes: 9EkQ1uliNrFe Found-by: Zheng Yu @ Depthfirst >From e284fcff976ae0292f0f7a274f2332611c0e05b0 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 15 Sep 2026 06:13:01 +0200 Subject: [PATCH] avformat/tee_common: reject slave options without a closing bracket Fixes: heap buffer overflow (read) Fixes: 9EkQ1uliNrFe Found-by: Zheng Yu @ Depthfirst --- libavformat/tee_common.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/tee_common.c b/libavformat/tee_common.c index e516b0a603..7b7148331a 100644 --- a/libavformat/tee_common.c +++ b/libavformat/tee_common.c @@ -21,6 +21,7 @@ #include <string.h> +#include "libavutil/error.h" #include "libavutil/log.h" #include "libavutil/opt.h" @@ -58,6 +59,11 @@ int ff_tee_parse_slave_options(void *log, char *slave, goto fail; if (strspn(p, slave_opt_close)) break; + if (!*p) { + av_log(log, AV_LOG_ERROR, "Unterminated slave options in \"%s\"\n", slave); + ret = AVERROR(EINVAL); + goto fail; + } p++; } *filename = (char *)p + 1; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
