PR #25302 opened by Marti2203 URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25302 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25302.patch
`decode_extradata_ps_mp4()` skips the retry with an escaped NAL when `AV_EF_EXPLODE` is set, which is intended. It then returns 0 anyway, so when the caller asks for errors to be fatal, a parameter set in avcC extradata that fails to parse is ignored. `h264_decode_init()` fails on extradata errors only with explode, so `avcodec_open2()` succeeds with `-err_detect explode` even when the avcC SPS is broken. The "Decoding sps %d from avcC failed" error path in `ff_h264_decode_extradata()` can never be reached. Annex B extradata already returns the error. `repro.sh` builds a small program against the built libraries. The program opens the h264 decoder with a valid avcC header whose SPS has an out-of-range `seq_parameter_set_id`, once with the default `err_recognition` and once with explode: ``` ./repro.sh /path/to/build /path/to/ffmpeg-source ``` Before (c50d6fca): ``` err_detect default: avcodec_open2() = 0 (success) err_detect explode: avcodec_open2() = 0 (success) ``` After: ``` [h264 @ 0x...] Error decoding the extradata err_detect default: avcodec_open2() = 0 (success) err_detect explode: avcodec_open2() = -1094995529 (Invalid data found when processing input) ``` Without explode nothing changes: the escaped retry still runs and its result is still ignored (lorex.mp4). With explode, an avcC that arrives as a packet (the `is_avcc_extradata()` path in `h264_decode_frame()`) now also returns the error. `AV_PKT_DATA_NEW_EXTRADATA` isn't affected, because its return value is ignored. Testing: `fate-h264` (231 tests, with samples) and `fate-source` pass. I didn't add a FATE test: it would need an h264 stream in an mp4/mov with crafted avcC, and FFmpeg has no h264 encoder to make one sample-free. I can add a small sample if wanted. This issue was found by an LLM-Enhanced Static Analysis Engine and verified manually. 🤖 Generated with [Claude Code](https://claude.com/claude-code) From c1910ce1cad4d333ca610b2840919d5eff3d6f0f Mon Sep 17 00:00:00 2001 From: Martin Mirchev <[email protected]> Date: Wed, 21 Oct 2026 18:24:34 +0800 Subject: [PATCH] avcodec/h264_parse: return SPS/PPS errors from avcC with explode decode_extradata_ps_mp4() skips the retry with an escaped NAL when AV_EF_EXPLODE is set, but then returns 0 regardless, so a parameter set that fails to parse in avcC extradata is silently ignored exactly when the caller asked for errors to be fatal. h264_decode_init() fails on extradata errors only with explode, so avcodec_open2() succeeded with -err_detect explode on avcC extradata with a broken SPS, and the "Decoding sps %d from avcC failed" path was unreachable. Return the error when explode is set. Signed-off-by: Martin Mirchev <[email protected]> --- libavcodec/h264_parse.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/h264_parse.c b/libavcodec/h264_parse.c index c6f9b3cea75..80573ae2510 100644 --- a/libavcodec/h264_parse.c +++ b/libavcodec/h264_parse.c @@ -424,7 +424,9 @@ static int decode_extradata_ps_mp4(const uint8_t *buf, int buf_size, H264ParamSe int ret; ret = decode_extradata_ps(buf, buf_size, ps, 1, logctx); - if (ret < 0 && !(err_recognition & AV_EF_EXPLODE)) { + if (ret < 0 && (err_recognition & AV_EF_EXPLODE)) + return ret; + if (ret < 0) { GetByteContext gbc; PutByteContext pbc; uint8_t *escaped_buf; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
