PR #24660 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24660 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24660.patch
Fixes: read into padding Fixes: 1SLVIPZzDH7n Found-by: zhang xingxing Suggested-by: zhang xingxing Replicated through Modified FFmpeg Signed-off-by: Michael Niedermayer <[email protected]> >From f4baedb57fb7875562db745181b4cd1b76049ecf Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 24 Sep 2026 00:16:33 +0200 Subject: [PATCH] avformat/rtpenc_jpeg: check that a marker segment lies within the frame Fixes: read into padding Fixes: 1SLVIPZzDH7n Found-by: zhang xingxing Suggested-by: zhang xingxing Replicated through Modified FFmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/rtpenc_jpeg.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/rtpenc_jpeg.c b/libavformat/rtpenc_jpeg.c index e4e95931f4..ddbce261d4 100644 --- a/libavformat/rtpenc_jpeg.c +++ b/libavformat/rtpenc_jpeg.c @@ -50,6 +50,11 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size) if (buf[i] != 0xff) continue; + if (size - i < 5 || (buf[i + 1] == SOF0 && size - i < 18)) { + av_log(s1, AV_LOG_ERROR, "Too short JPEG header. Aborted!\n"); + return; + } + if (buf[i + 1] == DQT) { int tables, j; if (buf[i + 4] & 0xF0) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
