[FFmpeg-devel] [PATCH] avformat/rtpdec_rfc4175: several bug fixes (PR #20803)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #20803 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20803
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20803.patch


>From ec17f9d7a3ec23b1efafd53978a8d5b2866d2f40 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 31 Oct 2025 16:17:27 +0100
Subject: [PATCH 1/3] avformat/rtpdec_rfc4175: Fix memleak of sampling

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/rtpdec_rfc4175.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c
index d6260ab69e..c41e4f19e0 100644
--- a/libavformat/rtpdec_rfc4175.c
+++ b/libavformat/rtpdec_rfc4175.c
@@ -128,7 +128,7 @@ static int rfc4175_parse_fmtp(AVFormatContext *s, AVStream *stream,
         data->width = atoi(value);
     else if (!strncmp(attr, "height", 6))
         data->height = atoi(value);
-    else if (!strncmp(attr, "sampling", 8))
+    else if (data->sampling == NULL && !strncmp(attr, "sampling", 8))
         data->sampling = av_strdup(value);
     else if (!strncmp(attr, "depth", 5))
         data->depth = atoi(value);
-- 
2.49.1


>From 90b4c0094eb52dbac388803482e0704121a752ca Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 31 Oct 2025 16:27:56 +0100
Subject: [PATCH 2/3] avformat/rtpdec_rfc4175: Only change PayloadContext on
 success

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/rtpdec_rfc4175.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c
index c41e4f19e0..d793f56949 100644
--- a/libavformat/rtpdec_rfc4175.c
+++ b/libavformat/rtpdec_rfc4175.c
@@ -23,6 +23,7 @@
 
 #include "avio_internal.h"
 #include "rtpdec_formats.h"
+#include "libavutil/avassert.h"
 #include "libavutil/avstring.h"
 #include "libavutil/mem.h"
 #include "libavutil/pixdesc.h"
@@ -172,30 +173,36 @@ static int rfc4175_parse_fmtp(AVFormatContext *s, AVStream *stream,
 }
 
 static int rfc4175_parse_sdp_line(AVFormatContext *s, int st_index,
-                                  PayloadContext *data, const char *line)
+                                  PayloadContext *data_arg, const char *line)
 {
     const char *p;
 
     if (st_index < 0)
         return 0;
 
+    av_assert0(!data_arg->sampling);
+
     if (av_strstart(line, "fmtp:", &p)) {
         AVStream *stream = s->streams[st_index];
+        PayloadContext data0 = *data_arg, *data = &data0;
         int ret = ff_parse_fmtp(s, stream, data, p, rfc4175_parse_fmtp);
 
-        if (ret < 0)
-            return ret;
-
-
         if (!data->sampling || !data->depth || !data->width || !data->height)
-            return AVERROR(EINVAL);
+            ret =  AVERROR(EINVAL);
+
+        if (ret < 0)
+            goto fail;
+
 
         stream->codecpar->width = data->width;
         stream->codecpar->height = data->height;
 
         ret = rfc4175_parse_format(stream, data);
         av_freep(&data->sampling);
-
+        if (ret >= 0)
+            *data_arg = *data;
+fail:
+        av_freep(&data->sampling);
         return ret;
     }
 
-- 
2.49.1


>From 26ddbac6eccdfdf5cf8b1088a4c28292ba9d49e0 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 31 Oct 2025 16:28:49 +0100
Subject: [PATCH 3/3] avformat/rtpdec_rfc4175: Check dimensions

Fixes: out of array access
Fixes: zeropath/int_overflow_in_rtpdec_rfc4175

Found-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/rtpdec_rfc4175.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c
index d793f56949..b49fc55d2d 100644
--- a/libavformat/rtpdec_rfc4175.c
+++ b/libavformat/rtpdec_rfc4175.c
@@ -25,6 +25,7 @@
 #include "rtpdec_formats.h"
 #include "libavutil/avassert.h"
 #include "libavutil/avstring.h"
+#include "libavutil/imgutils.h"
 #include "libavutil/mem.h"
 #include "libavutil/pixdesc.h"
 #include "libavutil/parseutils.h"
@@ -193,6 +194,9 @@ static int rfc4175_parse_sdp_line(AVFormatContext *s, int st_index,
         if (ret < 0)
             goto fail;
 
+        ret = av_image_check_size(data->width, data->height, 0, s);
+        if (ret < 0)
+            goto fail;
 
         stream->codecpar->width = data->width;
         stream->codecpar->height = data->height;
@@ -303,6 +307,9 @@ static int rfc4175_handle_packet(AVFormatContext *ctx, PayloadContext *data,
         if (data->interlaced)
             line = 2 * line + field;
 
+        if (line >= data->height)
+            return AVERROR_INVALIDDATA;
+
         /* prevent ill-formed packets to write after buffer's end */
         copy_offset = (line * data->width + offset) * data->pgroup / data->xinc;
         if (copy_offset + length > data->frame_size || !data->frame)
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org