PR #24876 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24876 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24876.patch
Fixes: out of array access Fixes: signed integer overflow Fixes: rfc4175_overflow.mxf Fixes: fKcw8qCE1cYW Found-by: Exocija >From a79c476595a4568922a0fd89dddc3e5039f159aa Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 2 Oct 2026 19:49:51 +0200 Subject: [PATCH 1/5] avformat/rtpenc: Limit RFC 4175 dimensions to 32767 Fixes: out of array access Fixes: signed integer overflow Fixes: rfc4175_overflow.mxf Fixes: fKcw8qCE1cYW Found-by: Exocija --- libavformat/rtpenc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/libavformat/rtpenc.c b/libavformat/rtpenc.c index 7c86b50975..dd08a9bbcb 100644 --- a/libavformat/rtpenc.c +++ b/libavformat/rtpenc.c @@ -228,9 +228,15 @@ static int rtp_write_header(AVFormatContext *s1) s->nal_length_size = (st->codecpar->extradata[21] & 0x03) + 1; } break; - case AV_CODEC_ID_MJPEG: case AV_CODEC_ID_BITPACKED: case AV_CODEC_ID_RAWVIDEO: + if (st->codecpar->width > 32767 || st->codecpar->height > 32767) { + av_log(s1, AV_LOG_ERROR, "dimensions %dx%d too large for RFC 4175\n", + st->codecpar->width, st->codecpar->height); + return AVERROR(EINVAL); + } + av_fallthrough; + case AV_CODEC_ID_MJPEG: if (st->codecpar->width <= 0 || st->codecpar->height <= 0) { av_log(s1, AV_LOG_ERROR, "dimensions not set\n"); return AVERROR(EINVAL); -- 2.52.0 >From f8871fdd5af752511a98af6f2a731eec876327b8 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 2 Oct 2026 19:50:47 +0200 Subject: [PATCH 2/5] avformat/rtpenc_rfc4175: Check that a pixel group fits in a packet Fixes: out of array access Fixes: infinite loop Fixes: JY8gU5Uv0e8b Found during triage of the security report fKcw8qCE1cYW Replicated through UnModified FFmpeg --- libavformat/rtpenc_rfc4175.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/rtpenc_rfc4175.c b/libavformat/rtpenc_rfc4175.c index 2120274f01..e7c8b2c02b 100644 --- a/libavformat/rtpenc_rfc4175.c +++ b/libavformat/rtpenc_rfc4175.c @@ -61,6 +61,11 @@ void ff_rtp_send_raw_rfc4175(AVFormatContext *s1, const uint8_t *buf, int size, return; } + if (s->max_payload_size < 2 + 6 + pgroup) { + av_log(s1, AV_LOG_ERROR, "Max payload size %d too low\n", s->max_payload_size); + return; + } + while (i < height) { int left = s->max_payload_size; uint8_t *dest = s->buf; -- 2.52.0 >From 0493d01dd4fdef52909cd4e4d3431a2ac84b27bc Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 2 Oct 2026 19:54:18 +0200 Subject: [PATCH 3/5] avformat/rtpenc_rfc4175: Do not send partially filled packets If the input packet ended before the data of a segment, the copy loop stopped but the RTP packet was still sent with the size of all its segments. The part of the payload that was not copied contained uninitialized memory of the packet buffer or data of the previous packet. Fixes: read of uninitialized memory Fixes: TluGFwVC22dC Found during triage of the security report fKcw8qCE1cYW Replicated through UnModified FFmpeg --- libavformat/rtpenc_rfc4175.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtpenc_rfc4175.c b/libavformat/rtpenc_rfc4175.c index e7c8b2c02b..aba8a88ada 100644 --- a/libavformat/rtpenc_rfc4175.c +++ b/libavformat/rtpenc_rfc4175.c @@ -134,7 +134,7 @@ void ff_rtp_send_raw_rfc4175(AVFormatContext *s1, const uint8_t *buf, int size, l_line = 2 * l_line + l_field; copy_offset = (l_line * (int64_t)width + l_off) * pgroup / xinc; if (copy_offset + length > size) - break; + return; memcpy (dest, buf + copy_offset, length); dest += length; } while (cont); -- 2.52.0 >From 1d5bdc44f923557131d43466aa23d8112e7aba0f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 2 Oct 2026 19:54:59 +0200 Subject: [PATCH 4/5] avformat/rtpenc_rfc4175: Split segments longer than 65535 bytes The Length field of the payload header is 16 bit. A scan line longer than 65535 bytes that fit into one packet was written with a truncated length and only that many bytes were copied, while the RTP packet was sent with the full size. The rest of the payload was uninitialized memory of the packet buffer or data of a previous packet. Fixes: read of uninitialized memory Fixes: RYTTcqy8RYDK Found during triage of the security report fKcw8qCE1cYW Replicated through UnModified FFmpeg --- libavformat/rtpenc_rfc4175.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/rtpenc_rfc4175.c b/libavformat/rtpenc_rfc4175.c index aba8a88ada..1c271f1d7a 100644 --- a/libavformat/rtpenc_rfc4175.c +++ b/libavformat/rtpenc_rfc4175.c @@ -87,10 +87,10 @@ void ff_rtp_send_raw_rfc4175(AVFormatContext *s1, const uint8_t *buf, int size, length = (pixels * pgroup) / xinc; left -= head_size; - if (left >= length) { + if (left >= length && length <= 0xFFFF) { next_line = 1; } else { - pixels = (left / pgroup) * xinc; + pixels = (FFMIN(left, 0xFFFF) / pgroup) * xinc; length = (pixels * pgroup) / xinc; next_line = 0; } -- 2.52.0 >From a9250220ed94547d3220f483f6cc48031ac63580 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 2 Oct 2026 19:53:39 +0200 Subject: [PATCH 5/5] avformat/rtpenc_rfc4175: Start the second field at frame line 1 The line counter of the second field started at 0 like the one of the first field. With an odd height the second field thus ended with a line below the last line of the frame, which was sent with stale data from the packet buffer. Fixes: line below the frame sent with stale data Found during triage of the security report fKcw8qCE1cYW Replicated through UnModified FFmpeg --- libavformat/rtpenc_rfc4175.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtpenc_rfc4175.c b/libavformat/rtpenc_rfc4175.c index 1c271f1d7a..764628b27b 100644 --- a/libavformat/rtpenc_rfc4175.c +++ b/libavformat/rtpenc_rfc4175.c @@ -27,7 +27,7 @@ void ff_rtp_send_raw_rfc4175(AVFormatContext *s1, const uint8_t *buf, int size, int width = s1->streams[0]->codecpar->width; int height = s1->streams[0]->codecpar->height; int xinc, yinc, pgroup; - int i = 0; + int i = field; int offset = 0; s->timestamp = s->cur_timestamp; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
