PR #22986 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22986
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22986.patch
fftools/ffmpeg_opt: validate stream index in negative map handling
Browse source
Operations
Negative -map processing iterates previously parsed stream map entries
and dereferences input_files[m->file_index]->ctx->streams[m->stream_index]
without validating that stream_index is in range.
A malformed earlier map can leave m->stream_index negative, which causes
an out-of-bounds read when a later negative map walks existing entries.
Check that stream_index is non-negative and below nb_streams before
calling stream_specifier_match().
*Vulnerability reported by Zhenpeng (Leo) Lin at depthfirst*
*Patch validated by Zheng Yu at depthfirst*
Fixes: DFVULN-695
>From f32b92c4374b9692a9b14060c78c1d14adc1c394 Mon Sep 17 00:00:00 2001
From: "depthfirst-dev[bot]"
<1012587+depthfirst-dev[bot]@users.noreply.github.com>
Date: Thu, 23 Apr 2026 02:47:11 +0000
Subject: [PATCH 1/2] fftools/ffmpeg_opt: validate stream index in negative map
handling
Negative -map processing iterates previously parsed stream map entries
and dereferences input_files[m->file_index]->ctx->streams[m->stream_index]
without validating that stream_index is in range.
A malformed earlier map can leave m->stream_index negative, which causes
an out-of-bounds read when a later negative map walks existing entries.
Check that stream_index is non-negative and below nb_streams before
calling stream_specifier_match().
*Vulnerability reported by Zhenpeng (Leo) Lin at depthfirst*
*Patch validated by Zheng Yu at depthfirst*
Fixes: DFVULN-695
---
fftools/ffmpeg_opt.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fftools/ffmpeg_opt.c b/fftools/ffmpeg_opt.c
index 48e6816c19..55268cd0a5 100644
--- a/fftools/ffmpeg_opt.c
+++ b/fftools/ffmpeg_opt.c
@@ -645,6 +645,8 @@ static int opt_map(void *optctx, const char *opt, const
char *arg)
for (i = 0; i < o->nb_stream_maps; i++) {
m = &o->stream_maps[i];
if (file_idx == m->file_index &&
+ m->stream_index >= 0 &&
+ m->stream_index < input_files[m->file_index]->nb_streams &&
stream_specifier_match(&ss,
input_files[m->file_index]->ctx,
input_files[m->file_index]->ctx->streams[m->stream_index],
--
2.52.0
>From 36b6052b71fc6ebc150b4dfea749ec469dd60bce Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Fri, 1 May 2026 17:23:15 +0200
Subject: [PATCH 2/2] fftools/ffmpeg_opt: fix mismatching negative maps
Fixes: -f lavfi -i testsrc2=size=128x128:rate=1:d=1 -filter_complex
'[0:v]scale=64:64[vout]' -map '[vout]' -map -0:v -f null -
Previously -0:v matched [vout] apparently
Signed-off-by: Michael Niedermayer <[email protected]>
---
fftools/ffmpeg_opt.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fftools/ffmpeg_opt.c b/fftools/ffmpeg_opt.c
index 55268cd0a5..28e6cee741 100644
--- a/fftools/ffmpeg_opt.c
+++ b/fftools/ffmpeg_opt.c
@@ -645,6 +645,7 @@ static int opt_map(void *optctx, const char *opt, const
char *arg)
for (i = 0; i < o->nb_stream_maps; i++) {
m = &o->stream_maps[i];
if (file_idx == m->file_index &&
+ !m->linklabel &&
m->stream_index >= 0 &&
m->stream_index < input_files[m->file_index]->nb_streams &&
stream_specifier_match(&ss,
--
2.52.0
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
