[FFmpeg-devel] [PR] avformat/whip: fix out-of-bounds write in bundle string when no streams (PR #22303)

[Nariman-Sayed via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #22303 opened by Nariman-Sayed
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22303
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22303.patch

When neither audio_par nor video_par is set, bundle_index remains 0,
causing bundle[-1] = '\0' which is an out-of-bounds write.

Fix by checking bundle_index before accessing the array.


>From 3b5c25568cc34f6b4c6f03f4bb5a0e3c436b0525 Mon Sep 17 00:00:00 2001
From: Nariman-Sayed <narimansayed28@gmail.com>
Date: Fri, 27 Feb 2026 02:47:54 +0200
Subject: [PATCH] avformat/whip: fix out-of-bounds write in bundle string when
 no streams

---
 libavformat/whip.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavformat/whip.c b/libavformat/whip.c
index 8306296b20..affdb0d6e3 100644
--- a/libavformat/whip.c
+++ b/libavformat/whip.c
@@ -641,7 +641,10 @@ static int generate_sdp_offer(AVFormatContext *s)
         bundle[bundle_index++] = '1';
         bundle[bundle_index++] = ' ';
     }
-    bundle[bundle_index - 1] = '\0';
+    if (bundle_index > 0)
+        bundle[bundle_index - 1] = '\0';
+    else
+        bundle[0] = '\0';
 
     av_bprintf(&bp, ""
         "v=0\r\n"
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org