From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 6E0554CE67 for ; Fri, 31 Oct 2025 15:54:01 +0000 (UTC) Authentication-Results: ffbox; dkim=fail (body hash mismatch (got b'RW728mgKYivHTrjLw+Ja+ydrMI2+U3F/NVBOoHMAD1w=', expected b'XUDTUk32mMtJcV0Ji3TPIB+fQftNr2ZDgQmwuSn6QxY=')) header.d=ffmpeg.org header.i=@ffmpeg.org header.a=rsa-sha256 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1761926033; h=mime-version : to : date : message-id : reply-to : subject : list-id : list-archive : list-archive : list-help : list-owner : list-post : list-subscribe : list-unsubscribe : from : cc : content-type : content-transfer-encoding : from; bh=RW728mgKYivHTrjLw+Ja+ydrMI2+U3F/NVBOoHMAD1w=; b=r1t0jg+828rO536gxLho7wetiyrVLtdnaydosYkvsG/aEGw5DFSMaBg0EvT/osVbuBBXj tcwMJFtxu0q72tqMXFtAPQN5NlatVSXdUibUgj+TMeGdQX7ArFmKB4txTXT2EVPK+zmYaMx myj87Qta3RE20NB6GyTp9FuUaNm3qzpohkBWW6fq0XxAuoEvdMEu7s3ZzwkYCpHfXgWn4Fd oKkcb1NGdXlIQRTpYW/J/UfiQgJGTaPKarP/n+3GM4DgOeRbryLw6ab3yPqADKVTwYx1/3r rT0ypiAxfXxfTwmPjGQLaJtV4AYW4GtkGNkoIoVgf1btFTdV04XwWFnDWibw== Received: from [172.19.0.2] (unknown [172.19.0.2]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 3ABA468FA1E; Fri, 31 Oct 2025 17:53:53 +0200 (EET) ARC-Seal: i=1; cv=none; a=rsa-sha256; d=ffmpeg.org; s=arc; t=1761926019; b=UHlQGEV9lG50f88G2Aypf06VLyhV9jUjf8I2vCrfkcwYfIevOmmrqgZk0tOyWUinka9xa Tol/uPq1o9SNGUv4AXa7boacJ4LkpnXFAd7Mh4W7uW4eT2v7neSd+hSJ0dsTKek9r4cJ+RK vyNOmEK1/fTGw5AprQe+l9Pgr6bamNNK25nkHiDoMXgHmG7eetRNd5WeOfqCQTtGm4WSyc6 OHRo1fgxDlVmIetsvsnr7ukX9DYnSEI764FRpeu/STPFCT4debXlLBXsFkMePc6pbT0wnCF hKkHxvQHV8fArMFP/KNzbPv/7ruAp7LrUCB1YRtS4hXa2bCb7CDNnKi/2oFg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=ffmpeg.org; s=arc; t=1761926019; h=from : sender : reply-to : subject : date : message-id : to : cc : mime-version : content-type : content-transfer-encoding : content-id : content-description : resent-date : resent-from : resent-sender : resent-to : resent-cc : resent-message-id : in-reply-to : references : list-id : list-help : list-unsubscribe : list-subscribe : list-post : list-owner : list-archive; bh=EtGdP8NxtnRwZTkwzNIVdvykzOy6+Ib5j6v5VWVs/w0=; b=TgGHnwGioZP3ji7+H4axa9t2inFYzBd5O43OhAAKeT6luovDycqlPTxJSyJHkqrI3FAKs gzzhCONdBLE9BIVXuCNqTIx7HMGV5GpsZk2cJksbs8KdThd889oPEMP3ULq4yUXx/yPEHkx cdL7xcY5C1b9+sJhpYU2c/oSvfKqvxVpTj6Llx/epkvwTcH1eZyuZdaXBLd2uVuWaLZq2Px 3XSE3uDaxICQHhEAs3rYveIDD7r8NT/dIs4mfqsr8xtpamF8WuO7Gbfa+/lXl8IGQNASYsl aNYaJKn/hfSwlzHH61H3u9AkN0Yg3TlJnYbXBNJ8JNPe3I8/mQygmkETi6BQ== ARC-Authentication-Results: i=1; ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none; dmarc=pass header.from=ffmpeg.org policy.dmarc=quarantine Authentication-Results: ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none (Message is not ARC signed); dmarc=pass (Used From Domain Record) header.from=ffmpeg.org policy.dmarc=quarantine DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1761926012; h=content-type : mime-version : content-transfer-encoding : from : to : reply-to : subject : date : from; bh=XUDTUk32mMtJcV0Ji3TPIB+fQftNr2ZDgQmwuSn6QxY=; b=32Tw7RBhJk+eb7nq44AUCmuzecjuYj+K2EZLf+FcFeH+8KVezwfLPMQGxM9pvWdEFOOSz UTAB5HBG4qTPcncXXnwOC3vqz/2ia/pr4GKEN//7GRrU/uoJUjJtiBN3GTXsF89sCQKid82 adUtsoF1FM9FaBvs5Hl+/IWcHlix4ZV9s26VVgRxo5PP3vo7zLkw/nKiZ2UGEJdzteyVsAH PZyzNMDLEGXwpybM61Xe9aNXpftGzJyr6ZeUF0SUmqV5jQaAa84ip/haGh+G6TLdhVbDmc3 uxqbF3TiICSSsji0RGkEEwaEmcoTbgemwpTm/SgZaNsiMH12uULe0YcUrwPQ== Received: from 02c22a36bd31 (code.ffmpeg.org [188.245.149.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id DA5E568F92C for ; Fri, 31 Oct 2025 17:53:32 +0200 (EET) MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Date: Fri, 31 Oct 2025 15:53:32 -0000 Message-ID: <176192601298.25.9073896908029376138@2cb04c0e5124> Message-ID-Hash: AXWC3CWGHPWUL7FMKRQFAL4U3RX3NKKL X-Message-ID-Hash: AXWC3CWGHPWUL7FMKRQFAL4U3RX3NKKL X-MailFrom: code@ffmpeg.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-ffmpeg-devel.ffmpeg.org-0; header-match-ffmpeg-devel.ffmpeg.org-1; header-match-ffmpeg-devel.ffmpeg.org-2; header-match-ffmpeg-devel.ffmpeg.org-3; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list Reply-To: FFmpeg development discussions and patches Subject: [FFmpeg-devel] [PATCH] avformat/rtpdec_rfc4175: several bug fixes (PR #20803) List-Id: FFmpeg development discussions and patches Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: michaelni via ffmpeg-devel Cc: michaelni Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Archived-At: List-Archive: List-Post: PR #20803 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20803 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20803.patch >>From ec17f9d7a3ec23b1efafd53978a8d5b2866d2f40 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 31 Oct 2025 16:17:27 +0100 Subject: [PATCH 1/3] avformat/rtpdec_rfc4175: Fix memleak of sampling Signed-off-by: Michael Niedermayer --- libavformat/rtpdec_rfc4175.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c index d6260ab69e..c41e4f19e0 100644 --- a/libavformat/rtpdec_rfc4175.c +++ b/libavformat/rtpdec_rfc4175.c @@ -128,7 +128,7 @@ static int rfc4175_parse_fmtp(AVFormatContext *s, AVStream *stream, data->width = atoi(value); else if (!strncmp(attr, "height", 6)) data->height = atoi(value); - else if (!strncmp(attr, "sampling", 8)) + else if (data->sampling == NULL && !strncmp(attr, "sampling", 8)) data->sampling = av_strdup(value); else if (!strncmp(attr, "depth", 5)) data->depth = atoi(value); -- 2.49.1 >>From 90b4c0094eb52dbac388803482e0704121a752ca Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 31 Oct 2025 16:27:56 +0100 Subject: [PATCH 2/3] avformat/rtpdec_rfc4175: Only change PayloadContext on success Signed-off-by: Michael Niedermayer --- libavformat/rtpdec_rfc4175.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c index c41e4f19e0..d793f56949 100644 --- a/libavformat/rtpdec_rfc4175.c +++ b/libavformat/rtpdec_rfc4175.c @@ -23,6 +23,7 @@ #include "avio_internal.h" #include "rtpdec_formats.h" +#include "libavutil/avassert.h" #include "libavutil/avstring.h" #include "libavutil/mem.h" #include "libavutil/pixdesc.h" @@ -172,30 +173,36 @@ static int rfc4175_parse_fmtp(AVFormatContext *s, AVStream *stream, } static int rfc4175_parse_sdp_line(AVFormatContext *s, int st_index, - PayloadContext *data, const char *line) + PayloadContext *data_arg, const char *line) { const char *p; if (st_index < 0) return 0; + av_assert0(!data_arg->sampling); + if (av_strstart(line, "fmtp:", &p)) { AVStream *stream = s->streams[st_index]; + PayloadContext data0 = *data_arg, *data = &data0; int ret = ff_parse_fmtp(s, stream, data, p, rfc4175_parse_fmtp); - if (ret < 0) - return ret; - - if (!data->sampling || !data->depth || !data->width || !data->height) - return AVERROR(EINVAL); + ret = AVERROR(EINVAL); + + if (ret < 0) + goto fail; + stream->codecpar->width = data->width; stream->codecpar->height = data->height; ret = rfc4175_parse_format(stream, data); av_freep(&data->sampling); - + if (ret >= 0) + *data_arg = *data; +fail: + av_freep(&data->sampling); return ret; } -- 2.49.1 >>From 26ddbac6eccdfdf5cf8b1088a4c28292ba9d49e0 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 31 Oct 2025 16:28:49 +0100 Subject: [PATCH 3/3] avformat/rtpdec_rfc4175: Check dimensions Fixes: out of array access Fixes: zeropath/int_overflow_in_rtpdec_rfc4175 Found-by: Joshua Rogers Signed-off-by: Michael Niedermayer --- libavformat/rtpdec_rfc4175.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c index d793f56949..b49fc55d2d 100644 --- a/libavformat/rtpdec_rfc4175.c +++ b/libavformat/rtpdec_rfc4175.c @@ -25,6 +25,7 @@ #include "rtpdec_formats.h" #include "libavutil/avassert.h" #include "libavutil/avstring.h" +#include "libavutil/imgutils.h" #include "libavutil/mem.h" #include "libavutil/pixdesc.h" #include "libavutil/parseutils.h" @@ -193,6 +194,9 @@ static int rfc4175_parse_sdp_line(AVFormatContext *s, int st_index, if (ret < 0) goto fail; + ret = av_image_check_size(data->width, data->height, 0, s); + if (ret < 0) + goto fail; stream->codecpar->width = data->width; stream->codecpar->height = data->height; @@ -303,6 +307,9 @@ static int rfc4175_handle_packet(AVFormatContext *ctx, PayloadContext *data, if (data->interlaced) line = 2 * line + field; + if (line >= data->height) + return AVERROR_INVALIDDATA; + /* prevent ill-formed packets to write after buffer's end */ copy_offset = (line * data->width + offset) * data->pgroup / data->xinc; if (copy_offset + length > data->frame_size || !data->frame) -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org