PR #24640 opened by Kacper Michajłow (kasper93) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24640 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24640.patch
From 5d572012598543b2d08ef970a9c2f5e2d3612d31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <[email protected]> Date: Wed, 23 Sep 2026 00:20:45 +0200 Subject: [PATCH 1/2] avformat/img2dec: do not let a complete PNG outscore what follows it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit png_probe returns AVPROBE_SCORE_MAX - 1 on the signature alone, so a 1x1 PNG prepended to an MPEG-TS segment wins the first probe iteration whenever mpegts cannot reach AVPROBE_SCORE_MAX, and the probe loop never looks any further. Some CDNs serve HLS segments this way to pass image only content filters, and once the leading packet is damaged mpegts only scores 49 in the first 2048 bytes. png_pipe demuxes a sequence of images, so once a whole image is inside the probe buffer it has to be followed by another signature or by the end of the input. Walk the chunks and return AVPROBE_SCORE_RETRY when IEND is followed by anything else. Fixes: https://github.com/mpv-player/mpv/issues/11365 Signed-off-by: Kacper Michajłow <[email protected]> --- libavformat/img2dec.c | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c index d5718eff41..91569e7b27 100644 --- a/libavformat/img2dec.c +++ b/libavformat/img2dec.c @@ -892,10 +892,32 @@ static int pictor_probe(const AVProbeData *p) static int png_probe(const AVProbeData *p) { const uint8_t *b = p->buf; + int size = p->buf_size; + int pos = 8; - if (AV_RB64(b) == 0x89504e470d0a1a0a) - return AVPROBE_SCORE_MAX - 1; - return 0; + if (AV_RB64(b) != 0x89504e470d0a1a0a) + return 0; + + /* png_pipe demuxes a sequence of images, so once a whole image is in + * the buffer it has to be followed by another signature or by the end + * of the input. Anything else is an unrelated payload behind a PNG, + * like the 1x1 image some CDNs prepend to MPEG-TS segments, and the + * signature alone must not outscore the demuxer of that payload. */ + while (pos + 12 <= size) { + uint32_t len = AV_RB32(b + pos); + uint32_t tag = AV_RB32(b + pos + 4); + + if (len > size - pos - 12) + break; + pos += 12 + len; + if (tag == MKBETAG('I', 'E', 'N', 'D')) { + if (pos + 8 <= size && AV_RB64(b + pos) != 0x89504e470d0a1a0a) + return AVPROBE_SCORE_RETRY; + break; + } + } + + return AVPROBE_SCORE_MAX - 1; } static int psd_probe(const AVProbeData *p) -- 2.52.0 From 81164e6e6a6ea898888a16b898bf89f026e3e824 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <[email protected]> Date: Wed, 23 Sep 2026 00:23:13 +0200 Subject: [PATCH 2/2] fate/probe: test mpeg-ts behind a png with an unaligned first packet MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The sample is the first 2040 bytes of a segment from https://github.com/mpv-player/mpv/issues/11365, a 1x1 PNG followed by an SDT packet missing 6 bytes and then aligned packets. That is the smallest input which fills the ten packet slots mpegts_probe needs to score it, any less and png_pipe wins the probe either way. Signed-off-by: Kacper Michajłow <[email protected]> --- tests/fate/probe.mak | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/fate/probe.mak b/tests/fate/probe.mak index e94206f981..3b56d0f502 100644 --- a/tests/fate/probe.mak +++ b/tests/fate/probe.mak @@ -22,6 +22,9 @@ fate-probe-format-mp3-with-art: REF = mp3 FATE_PROBE_FORMAT-$(CONFIG_MPEGTS_DEMUXER) += fate-probe-format-mpegts-png-prefix fate-probe-format-mpegts-png-prefix: REF = mpegts +FATE_PROBE_FORMAT-$(CONFIG_MPEGTS_DEMUXER) += fate-probe-format-mpegts-png-prefix-unaligned +fate-probe-format-mpegts-png-prefix-unaligned: REF = mpegts + FATE_PROBE_FORMAT-$(call ALLYES, IMAGE_TIFF_PIPE_DEMUXER MPEGTS_DEMUXER) += fate-probe-format-tiff-not-mpegts fate-probe-format-tiff-not-mpegts: REF = tiff_pipe -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
