PR #24539 opened by Thomas Devoogdt (ThomasDevoogdt) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24539 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24539.patch
Guard on the counter that is actually indexed. >From 1eac2088dacb33dcb6d12892ae3dc040fe852e19 Mon Sep 17 00:00:00 2001 From: Thomas Devoogdt <[email protected]> Date: Fri, 11 Sep 2026 09:57:51 +0200 Subject: [PATCH 1/2] avformat/rtsp: guard SDP a=ssrc: on the RTSP stream count The attribute reads rt->rtsp_streams[rt->nb_rtsp_streams - 1], but was guarded on s->nb_streams, which counts AVStreams. The two are not the same: the MP2T branch of the SDP parser creates an RTSPStream without an AVStream, since the contained streams are only known once packets arrive. An a=ssrc: line in such a media section was therefore dropped. Guard on the counter that is actually indexed. Signed-off-by: Thomas Devoogdt <[email protected]> --- libavformat/rtsp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c index 51754f5d26..d20b2902e9 100644 --- a/libavformat/rtsp.c +++ b/libavformat/rtsp.c @@ -653,7 +653,7 @@ static void sdp_parse_line(AVFormatContext *s, SDPParseState *s1, st = s->streams[s->nb_streams - 1]; st->avg_frame_rate = av_d2q(framerate, INT_MAX); } - } else if (av_strstart(p, "ssrc:", &p) && s->nb_streams > 0) { + } else if (av_strstart(p, "ssrc:", &p) && rt->nb_rtsp_streams > 0) { rtsp_st = rt->rtsp_streams[rt->nb_rtsp_streams - 1]; get_word(buf1, sizeof(buf1), &p); rtsp_st->ssrc = strtoll(buf1, NULL, 10); -- 2.52.0 >From 210da73856623b0ab748476ac38803f76d6f2663 Mon Sep 17 00:00:00 2001 From: Thomas Devoogdt <[email protected]> Date: Fri, 11 Sep 2026 09:54:40 +0200 Subject: [PATCH 2/2] avformat/rtsp: guard SDP a=crypto: on the RTSP stream count The attribute reads rt->rtsp_streams[rt->nb_rtsp_streams - 1], but was guarded on s->nb_streams, which counts AVStreams. The two are not the same: the MP2T branch of the SDP parser creates an RTSPStream without an AVStream, since the contained streams are only known once packets arrive. An a=crypto: line in such a media section was therefore dropped and the session set up unprotected. Guard on the counter that is actually indexed. Signed-off-by: Thomas Devoogdt <[email protected]> --- libavformat/rtsp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c index d20b2902e9..a6dcfdb1bd 100644 --- a/libavformat/rtsp.c +++ b/libavformat/rtsp.c @@ -683,7 +683,7 @@ static void sdp_parse_line(AVFormatContext *s, SDPParseState *s1, s->nb_streams > 0) { st = s->streams[s->nb_streams - 1]; st->codecpar->sample_rate = atoi(p); - } else if (av_strstart(p, "crypto:", &p) && s->nb_streams > 0) { + } else if (av_strstart(p, "crypto:", &p) && rt->nb_rtsp_streams > 0) { // RFC 4568 rtsp_st = rt->rtsp_streams[rt->nb_rtsp_streams - 1]; get_word(buf1, sizeof(buf1), &p); // ignore tag -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
