PR #24099 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24099 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24099.patch
>From 06974f00f2ac6b037142ea69c160d98e61214959 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 12 Aug 2026 01:34:26 +0200 Subject: [PATCH 1/2] avformat/mpegts: keep the PES payload within max_packet_size Fixes: out of array access Fixes: eYvYXUJZbPJ Regression since: bca30570d28bbaa07badadabf55ec3589201a82f Found-by: Eunsoo Kim, Microsoft FORGE Labs --- libavformat/mpegts.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 076020509d..326f07abb1 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -1461,7 +1461,8 @@ skip: do { int max_packet_size = ts->max_packet_size; if (pes->PES_packet_length && pes->PES_packet_length + PES_START_SIZE > pes->pes_header_size) - max_packet_size = pes->PES_packet_length + PES_START_SIZE - pes->pes_header_size; + max_packet_size = FFMIN(pes->PES_packet_length + PES_START_SIZE - pes->pes_header_size, + ts->max_packet_size); if (pes->data_index > 0 && pes->data_index + buf_size > max_packet_size) { -- 2.52.0 >From 67029736e4d338e29a692bed7f55a213b2ef1f9a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 12 Aug 2026 01:34:52 +0200 Subject: [PATCH 2/2] avformat/mpegts: reject a max_packet_size below one TS payload Fixes: ffmpeg -max_packet_size 100 -i fate-suite/mpegts/h264small.ts -f null - Fixes: out of array access Fixes: eYvYXUJZbPJ Regression since: bca30570d28bbaa07badadabf55ec3589201a82f Found-by: Eunsoo Kim, Microsoft FORGE Labs --- doc/demuxers.texi | 2 +- libavformat/mpegts.c | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/doc/demuxers.texi b/doc/demuxers.texi index a1dd879b59..8603069949 100644 --- a/doc/demuxers.texi +++ b/doc/demuxers.texi @@ -1008,7 +1008,7 @@ streams move to different PIDs. Default value is 0. @item max_packet_size Set maximum size, in bytes, of packet emitted by the demuxer. Payloads above this size -are split across multiple packets. Range is 1 to INT_MAX/2. Default is 204800 bytes. +are split across multiple packets. Range is 184 to INT_MAX/2. Default is 204800 bytes. @end table @section mpjpeg diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 326f07abb1..ca9d33671b 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -52,6 +52,9 @@ * synchronization is lost */ #define MAX_RESYNC_SIZE 65536 +/* payload of a TS packet which carries no adaptation field */ +#define TS_PAYLOAD_SIZE (TS_PACKET_SIZE - 4) + #define MAX_MP4_DESCR_COUNT 16 #define MOD_UNLIKELY(modulus, dividend, divisor, prev_dividend) \ @@ -223,7 +226,7 @@ static const AVOption options[] = { {"skip_clear", "skip clearing programs", offsetof(MpegTSContext, skip_clear), AV_OPT_TYPE_BOOL, {.i64 = 0}, 0, 1, 0 }, {"max_packet_size", "maximum size of emitted packet", offsetof(MpegTSContext, max_packet_size), AV_OPT_TYPE_INT, - {.i64 = 204800}, 1, INT_MAX/2, AV_OPT_FLAG_DECODING_PARAM }, + {.i64 = 204800}, TS_PAYLOAD_SIZE, INT_MAX/2, AV_OPT_FLAG_DECODING_PARAM }, { NULL }, }; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
