PR #20803 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20803 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20803.patch
>From ec17f9d7a3ec23b1efafd53978a8d5b2866d2f40 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 31 Oct 2025 16:17:27 +0100 Subject: [PATCH 1/3] avformat/rtpdec_rfc4175: Fix memleak of sampling Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/rtpdec_rfc4175.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c index d6260ab69e..c41e4f19e0 100644 --- a/libavformat/rtpdec_rfc4175.c +++ b/libavformat/rtpdec_rfc4175.c @@ -128,7 +128,7 @@ static int rfc4175_parse_fmtp(AVFormatContext *s, AVStream *stream, data->width = atoi(value); else if (!strncmp(attr, "height", 6)) data->height = atoi(value); - else if (!strncmp(attr, "sampling", 8)) + else if (data->sampling == NULL && !strncmp(attr, "sampling", 8)) data->sampling = av_strdup(value); else if (!strncmp(attr, "depth", 5)) data->depth = atoi(value); -- 2.49.1 >From 90b4c0094eb52dbac388803482e0704121a752ca Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 31 Oct 2025 16:27:56 +0100 Subject: [PATCH 2/3] avformat/rtpdec_rfc4175: Only change PayloadContext on success Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/rtpdec_rfc4175.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c index c41e4f19e0..d793f56949 100644 --- a/libavformat/rtpdec_rfc4175.c +++ b/libavformat/rtpdec_rfc4175.c @@ -23,6 +23,7 @@ #include "avio_internal.h" #include "rtpdec_formats.h" +#include "libavutil/avassert.h" #include "libavutil/avstring.h" #include "libavutil/mem.h" #include "libavutil/pixdesc.h" @@ -172,30 +173,36 @@ static int rfc4175_parse_fmtp(AVFormatContext *s, AVStream *stream, } static int rfc4175_parse_sdp_line(AVFormatContext *s, int st_index, - PayloadContext *data, const char *line) + PayloadContext *data_arg, const char *line) { const char *p; if (st_index < 0) return 0; + av_assert0(!data_arg->sampling); + if (av_strstart(line, "fmtp:", &p)) { AVStream *stream = s->streams[st_index]; + PayloadContext data0 = *data_arg, *data = &data0; int ret = ff_parse_fmtp(s, stream, data, p, rfc4175_parse_fmtp); - if (ret < 0) - return ret; - - if (!data->sampling || !data->depth || !data->width || !data->height) - return AVERROR(EINVAL); + ret = AVERROR(EINVAL); + + if (ret < 0) + goto fail; + stream->codecpar->width = data->width; stream->codecpar->height = data->height; ret = rfc4175_parse_format(stream, data); av_freep(&data->sampling); - + if (ret >= 0) + *data_arg = *data; +fail: + av_freep(&data->sampling); return ret; } -- 2.49.1 >From 26ddbac6eccdfdf5cf8b1088a4c28292ba9d49e0 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 31 Oct 2025 16:28:49 +0100 Subject: [PATCH 3/3] avformat/rtpdec_rfc4175: Check dimensions Fixes: out of array access Fixes: zeropath/int_overflow_in_rtpdec_rfc4175 Found-by: Joshua Rogers <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/rtpdec_rfc4175.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c index d793f56949..b49fc55d2d 100644 --- a/libavformat/rtpdec_rfc4175.c +++ b/libavformat/rtpdec_rfc4175.c @@ -25,6 +25,7 @@ #include "rtpdec_formats.h" #include "libavutil/avassert.h" #include "libavutil/avstring.h" +#include "libavutil/imgutils.h" #include "libavutil/mem.h" #include "libavutil/pixdesc.h" #include "libavutil/parseutils.h" @@ -193,6 +194,9 @@ static int rfc4175_parse_sdp_line(AVFormatContext *s, int st_index, if (ret < 0) goto fail; + ret = av_image_check_size(data->width, data->height, 0, s); + if (ret < 0) + goto fail; stream->codecpar->width = data->width; stream->codecpar->height = data->height; @@ -303,6 +307,9 @@ static int rfc4175_handle_packet(AVFormatContext *ctx, PayloadContext *data, if (data->interlaced) line = 2 * line + field; + if (line >= data->height) + return AVERROR_INVALIDDATA; + /* prevent ill-formed packets to write after buffer's end */ copy_offset = (line * data->width + offset) * data->pgroup / data->xinc; if (copy_offset + length > data->frame_size || !data->frame) -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
