PR #24568 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24568 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24568.patch
Fixes: unbounded allocation Fixes: qdm2_e2e.sdp / gen_qdm2_e2e.py Fixes: mrpG6wsAlxwu Found-by: Dubh3 <[email protected]> Suggested-by: Dubh3 <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> >From 21b0064b5f1aa5c6178f29cc656dd6b42e5a80ca Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 19 Sep 2026 20:48:10 +0200 Subject: [PATCH] avformat/rtpdec_qdm2: Reject block_size larger than the reassembly buffer Fixes: unbounded allocation Fixes: qdm2_e2e.sdp / gen_qdm2_e2e.py Fixes: mrpG6wsAlxwu Found-by: Dubh3 <[email protected]> Suggested-by: Dubh3 <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/rtpdec_qdm2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavformat/rtpdec_qdm2.c b/libavformat/rtpdec_qdm2.c index 9d71fe67dd..16fcb614a4 100644 --- a/libavformat/rtpdec_qdm2.c +++ b/libavformat/rtpdec_qdm2.c @@ -105,6 +105,10 @@ static int qdm2_parse_config(PayloadContext *qdm, AVStream *st, if (item_len < 30) return AVERROR_INVALIDDATA; + qdm->block_size = AV_RB32(p + 26); + if (qdm->block_size > sizeof(qdm->buf[0])) + return AVERROR_INVALIDDATA; + ret = ff_alloc_extradata(st->codecpar, 26 + item_len); if (ret < 0) { return ret; @@ -117,8 +121,6 @@ static int qdm2_parse_config(PayloadContext *qdm, AVStream *st, memcpy(st->codecpar->extradata + 20, p + 2, item_len - 2); AV_WB32(st->codecpar->extradata + 18 + item_len, 8); AV_WB32(st->codecpar->extradata + 22 + item_len, 0); - - qdm->block_size = AV_RB32(p + 26); break; } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
