PR #22900 opened by AdityaTeltia URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22900 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22900.patch
Fixes ticket #22890. The `ff_hls_senc_parse_audio_setup_info` function passes `setup_data` from `HLSAudioSetupInfo` to parsers like `avpriv_ac3_parse_header` and `init_get_bits8`. Both of these functions initialize or execute bit-readers that require the provided buffer to be padded with `AV_INPUT_BUFFER_PADDING_SIZE` bytes at the end to prevent uninitialized memory reads or out-of-bounds fetches. This patch: 1. Increases the `setup_data` array capacity by `AV_INPUT_BUFFER_PADDING_SIZE` bytes. 2. Explicitly zero-initializes the padded space immediately after parsing the `audio_setup_info` payload and confirming its length. >From 46c48bbaaf74f38354baaa123c4691498b1a9e2a Mon Sep 17 00:00:00 2001 From: AdityaTeltia <[email protected]> Date: Thu, 23 Apr 2026 12:27:53 +0530 Subject: [PATCH] avformat/hls_sample_encryption: add missing padding for audio setup buffer Fixes ticket #22890. The ff_hls_senc_parse_audio_setup_info function passes setup_data to parsers like avpriv_ac3_parse_header and init_get_bits8 which require the buffer to be padded with AV_INPUT_BUFFER_PADDING_SIZE bytes at the end. --- libavformat/hls_sample_encryption.c | 1 + libavformat/hls_sample_encryption.h | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/hls_sample_encryption.c b/libavformat/hls_sample_encryption.c index f9f410f3da..26de098dda 100644 --- a/libavformat/hls_sample_encryption.c +++ b/libavformat/hls_sample_encryption.c @@ -88,6 +88,7 @@ void ff_hls_senc_read_audio_setup_info(HLSAudioSetupInfo *info, const uint8_t *b return; memcpy(info->setup_data, buf, info->setup_data_length); + memset(info->setup_data + info->setup_data_length, 0, AV_INPUT_BUFFER_PADDING_SIZE); } int ff_hls_senc_parse_audio_setup_info(AVStream *st, HLSAudioSetupInfo *info) diff --git a/libavformat/hls_sample_encryption.h b/libavformat/hls_sample_encryption.h index e5a2eae01d..0f7e1c3ece 100644 --- a/libavformat/hls_sample_encryption.h +++ b/libavformat/hls_sample_encryption.h @@ -52,7 +52,7 @@ typedef struct HLSAudioSetupInfo { uint16_t priming; uint8_t version; uint8_t setup_data_length; - uint8_t setup_data[HLS_MAX_AUDIO_SETUP_DATA_LEN]; + uint8_t setup_data[HLS_MAX_AUDIO_SETUP_DATA_LEN + AV_INPUT_BUFFER_PADDING_SIZE]; } HLSAudioSetupInfo; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
