[FFmpeg-devel] [PR] fftools/ffmpeg_opt: limit recursion of presets (PR #21549)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21549 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21549
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21549.patch

Fixes: stack overflow

This should have limited security impact as it requires access to arbitrary
options.

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From 83e850020f16fe95556d802dbf981ee8305050e6 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 22 Jan 2026 21:11:34 +0100
Subject: [PATCH] fftools/ffmpeg_opt: limit recursion of presets

Fixes: stack overflow

This should have limited security impact as it requires access to arbitrary
options.

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 fftools/ffmpeg.h     | 2 ++
 fftools/ffmpeg_opt.c | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/fftools/ffmpeg.h b/fftools/ffmpeg.h
index 7720dd9c59..4d109fc015 100644
--- a/fftools/ffmpeg.h
+++ b/fftools/ffmpeg.h
@@ -258,6 +258,8 @@ typedef struct OptionsContext {
     SpecifierOptList enc_stats_pre_fmt;
     SpecifierOptList enc_stats_post_fmt;
     SpecifierOptList mux_stats_fmt;
+
+    int depth;
 } OptionsContext;
 
 enum IFilterFlags {
diff --git a/fftools/ffmpeg_opt.c b/fftools/ffmpeg_opt.c
index 80bb9236af..32d6b951f6 100644
--- a/fftools/ffmpeg_opt.c
+++ b/fftools/ffmpeg_opt.c
@@ -1110,6 +1110,12 @@ static int opt_preset(void *optctx, const char *opt, const char *arg)
     char filename[1000], line[1000], tmp_line[1000];
     const char *codec_name = NULL;
     int ret = 0;
+    int depth = o->depth;
+
+    if (depth > 2)  {
+        av_log(NULL, AV_LOG_ERROR, "too deep recursion\n");
+        return AVERROR(EINVAL);
+    }
 
     codec_name = opt_match_per_type_str(&o->codec_names, *opt);
 
@@ -1121,6 +1127,7 @@ static int opt_preset(void *optctx, const char *opt, const char *arg)
         return AVERROR(ENOENT);
     }
 
+    o->depth ++;
     while (fgets(line, sizeof(line), f)) {
         char *key = tmp_line, *value, *endptr;
 
@@ -1149,6 +1156,7 @@ static int opt_preset(void *optctx, const char *opt, const char *arg)
     }
 
 fail:
+    o->depth = depth;
     fclose(f);
 
     return ret;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org