PR #25731 opened by DeVshaurya01
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25731
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25731.patch

av_get_packet() sets pkt->pos to the chunk payload, 8 bytes past the ANMF 
header. With AVFMT_GENERIC_INDEX and no read_seek, seeking goes there and the 
next read parses frame data as a chunk header, so every seek ends in EOF and 
ffmpeg -ss outputs nothing.

Found-by: CS5187 grammar-aware seek-oracle fuzzer

Signed-off-by: Shaurya Atram <[email protected]>

# Summary of changes

Briefly describe what this PR does and why.

<!--
If this PR requires new FATE test samples, attach them to the PR and
list their target paths below (relative to the fate-suite root).

Attached filenames must match the sample's filename:

```fate-samples
# e.g. vorbis/new-sample.ogg
```
-->



>From ce836919d3b6377637827ff62cd44ea8bc416c23 Mon Sep 17 00:00:00 2001
From: Shaurya Atram <[email protected]>
Date: Tue, 3 Nov 2026 15:15:28 +0000
Subject: [PATCH] avformat/webp_anim_dec: set packet pos to the ANMF chunk
 start

av_get_packet() sets pkt->pos to the chunk payload, 8 bytes past the ANMF 
header. With AVFMT_GENERIC_INDEX and no read_seek, seeking goes there and the 
next read parses frame data as a chunk header, so every seek ends in EOF and 
ffmpeg -ss outputs nothing.

Found-by: CS5187 grammar-aware seek-oracle fuzzer

Signed-off-by: Shaurya Atram <[email protected]>
---
 libavformat/webp_anim_dec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavformat/webp_anim_dec.c b/libavformat/webp_anim_dec.c
index 14abb61db45..e81deea6c81 100644
--- a/libavformat/webp_anim_dec.c
+++ b/libavformat/webp_anim_dec.c
@@ -272,6 +272,7 @@ static int webp_anim_read_packet(AVFormatContext *s, 
AVPacket *pkt)
             ret = av_get_packet(pb, pkt, size);
             if (ret < 0)
                 return ret;
+            pkt->pos = offset;
             if (!ctx->cur_frame++)
                 pkt->flags |= AV_PKT_FLAG_KEY;
             pkt->pts = AV_NOPTS_VALUE;
-- 
2.54.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to