From: stevenliu via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>
To: ffmpeg-devel@ffmpeg.org
Cc: stevenliu <code@ffmpeg.org>
Subject: [FFmpeg-devel] [PR] avformat/dashdec: check value valid after read value from mpd xml (PR #21568)
Date: Sat, 24 Jan 2026 07:50:52 -0000
Message-ID: <176924105313.25.11045927441474285348@4457048688e7> (raw)
PR #21568 opened by stevenliu
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21568
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21568.patch
before this commit ffmpeg get Heap Buffer Overflow in DASH Demuxer
via Negative Start Number.
Check the value from mpd xml, set the value to 0 if get negative value.
Fixes: heap buffer overflow
Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
>From e0f26e0019ea8b4f17de56eddac943b5e2c7093f Mon Sep 17 00:00:00 2001
From: Steven Liu <lq@chinaffmpeg.org>
Date: Sat, 24 Jan 2026 15:22:15 +0800
Subject: [PATCH] avformat/dashdec: check value valid after read value from mpd
xml
before this commit ffmpeg get Heap Buffer Overflow in DASH Demuxer
via Negative Start Number.
Check the value from mpd xml, set the value to 0 if get negative value.
Fixes: heap buffer overflow
Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
---
libavformat/dashdec.c | 49 ++++++++++++++++++++++++++++++++++++-------
1 file changed, 42 insertions(+), 7 deletions(-)
diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index 500d8ca518..a41f4b7c5f 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -957,25 +957,45 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url,
}
val = get_val_from_nodes_tab(fragment_templates_tab, 4, "presentationTimeOffset");
if (val) {
- rep->presentation_timeoffset = (int64_t) strtoll(val, NULL, 10);
+ int64_t presentation_timeoffset = (int64_t) strtoll(val, NULL, 10);
+ if (presentation_timeoffset < 0) {
+ av_log(s, AV_LOG_WARNING, "The presentationTimeOffset value invalid, autochanged to 0.\n");
+ presentation_timeoffset = 0;
+ }
+ rep->presentation_timeoffset = presentation_timeoffset;
av_log(s, AV_LOG_TRACE, "rep->presentation_timeoffset = [%"PRId64"]\n", rep->presentation_timeoffset);
xmlFree(val);
}
val = get_val_from_nodes_tab(fragment_templates_tab, 4, "duration");
if (val) {
- rep->fragment_duration = (int64_t) strtoll(val, NULL, 10);
+ int64_t fragment_duration = (int64_t) strtoll(val, NULL, 10);
+ if (fragment_duration < 0) {
+ av_log(s, AV_LOG_WARNING, "The duration value invalid, autochanged to 0.\n");
+ fragment_duration = 0;
+ }
+ rep->fragment_duration = fragment_duration;
av_log(s, AV_LOG_TRACE, "rep->fragment_duration = [%"PRId64"]\n", rep->fragment_duration);
xmlFree(val);
}
val = get_val_from_nodes_tab(fragment_templates_tab, 4, "timescale");
if (val) {
- rep->fragment_timescale = (int64_t) strtoll(val, NULL, 10);
+ int64_t fragment_timescale = (int64_t) strtoll(val, NULL, 10);
+ if (fragment_timescale < 0) {
+ av_log(s, AV_LOG_WARNING, "The timescale value invalid, autochanged to 0.\n");
+ fragment_timescale = 0;
+ }
+ rep->fragment_timescale = fragment_timescale;
av_log(s, AV_LOG_TRACE, "rep->fragment_timescale = [%"PRId64"]\n", rep->fragment_timescale);
xmlFree(val);
}
val = get_val_from_nodes_tab(fragment_templates_tab, 4, "startNumber");
if (val) {
- rep->start_number = rep->first_seq_no = (int64_t) strtoll(val, NULL, 10);
+ int64_t start_number = (int64_t) strtoll(val, NULL, 10);
+ if (start_number < 0) {
+ av_log(s, AV_LOG_WARNING, "The startNumber value invalid, autochanged to 0.\n");
+ start_number = 0;
+ }
+ rep->start_number = rep->first_seq_no = start_number;
av_log(s, AV_LOG_TRACE, "rep->first_seq_no = [%"PRId64"]\n", rep->first_seq_no);
xmlFree(val);
}
@@ -1037,19 +1057,34 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url,
val = get_val_from_nodes_tab(segmentlists_tab, 3, "duration");
if (val) {
- rep->fragment_duration = (int64_t) strtoll(val, NULL, 10);
+ int64_t fragment_duration = (int64_t) strtoll(val, NULL, 10);
+ if (fragment_duration < 0) {
+ av_log(s, AV_LOG_WARNING, "The duration value invalid, autochanged to 0.\n");
+ fragment_duration = 0;
+ }
+ rep->fragment_duration = fragment_duration;
av_log(s, AV_LOG_TRACE, "rep->fragment_duration = [%"PRId64"]\n", rep->fragment_duration);
xmlFree(val);
}
val = get_val_from_nodes_tab(segmentlists_tab, 3, "timescale");
if (val) {
- rep->fragment_timescale = (int64_t) strtoll(val, NULL, 10);
+ int64_t fragment_timescale = (int64_t) strtoll(val, NULL, 10);
+ if (fragment_timescale < 0) {
+ av_log(s, AV_LOG_WARNING, "The timescale value invalid, autochanged to 0.\n");
+ fragment_timescale = 0;
+ }
+ rep->fragment_timescale = fragment_timescale;
av_log(s, AV_LOG_TRACE, "rep->fragment_timescale = [%"PRId64"]\n", rep->fragment_timescale);
xmlFree(val);
}
val = get_val_from_nodes_tab(segmentlists_tab, 3, "startNumber");
if (val) {
- rep->start_number = rep->first_seq_no = (int64_t) strtoll(val, NULL, 10);
+ int64_t start_number = (int64_t) strtoll(val, NULL, 10);
+ if (start_number < 0) {
+ av_log(s, AV_LOG_WARNING, "The startNumber value invalid, autochanged to 0.\n");
+ start_number = 0;
+ }
+ rep->start_number = rep->first_seq_no = start_number;
av_log(s, AV_LOG_TRACE, "rep->first_seq_no = [%"PRId64"]\n", rep->first_seq_no);
xmlFree(val);
}
--
2.52.0
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
reply other threads:[~2026-01-24 7:51 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=176924105313.25.11045927441474285348@4457048688e7 \
--to=ffmpeg-devel@ffmpeg.org \
--cc=code@ffmpeg.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git