* [FFmpeg-devel] [PATCH] avformat/rtpenc_h264_hevc: Check space for nal_length_size in ff_rtp_send_h264_hevc() (PR #20746)
@ 2025-10-24 18:52 michaelni via ffmpeg-devel
2025-10-24 22:03 ` [FFmpeg-devel] " Kieran Kunhya via ffmpeg-devel
0 siblings, 1 reply; 3+ messages in thread
From: michaelni via ffmpeg-devel @ 2025-10-24 18:52 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: michaelni
PR #20746 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746.patch
Fixes: memcpy with negative size
Fixes: momo_trip-poc/input
Reported-by: Momoko Shiraishi <shiraishi@os.is.s.u-tokyo.ac.jp>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
>From 3924caed9dd6345bcfa5ce09e9dbc8d5403a7525 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 24 Oct 2025 20:29:23 +0200
Subject: [PATCH] avformat/rtpenc_h264_hevc: Check space for nal_length_size in
ff_rtp_send_h264_hevc()
Fixes: memcpy with negative size
Fixes: momo_trip-poc/input
Reported-by: Momoko Shiraishi <shiraishi@os.is.s.u-tokyo.ac.jp>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/rtpenc_h264_hevc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/rtpenc_h264_hevc.c b/libavformat/rtpenc_h264_hevc.c
index 4d222dca75..ea19cb0627 100644
--- a/libavformat/rtpenc_h264_hevc.c
+++ b/libavformat/rtpenc_h264_hevc.c
@@ -196,6 +196,8 @@ void ff_rtp_send_h264_hevc(AVFormatContext *s1, const uint8_t *buf1, int size)
r1 = ff_nal_mp4_find_startcode(r, end, s->nal_length_size);
if (!r1)
r1 = end;
+ if (r1 - r < s->nal_length_size)
+ break;
r += s->nal_length_size;
} else {
while (!*(r++));
--
2.49.1
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
^ permalink raw reply [flat|nested] 3+ messages in thread* [FFmpeg-devel] Re: [PATCH] avformat/rtpenc_h264_hevc: Check space for nal_length_size in ff_rtp_send_h264_hevc() (PR #20746)
2025-10-24 18:52 [FFmpeg-devel] [PATCH] avformat/rtpenc_h264_hevc: Check space for nal_length_size in ff_rtp_send_h264_hevc() (PR #20746) michaelni via ffmpeg-devel
@ 2025-10-24 22:03 ` Kieran Kunhya via ffmpeg-devel
2025-10-25 22:50 ` Michael Niedermayer via ffmpeg-devel
0 siblings, 1 reply; 3+ messages in thread
From: Kieran Kunhya via ffmpeg-devel @ 2025-10-24 22:03 UTC (permalink / raw)
To: FFmpeg development discussions and patches; +Cc: michaelni, Kieran Kunhya
On Fri, 24 Oct 2025, 14:52 michaelni via ffmpeg-devel, <
ffmpeg-devel@ffmpeg.org> wrote:
> PR #20746 opened by michaelni
> URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746
> Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746.patch
>
> Fixes: memcpy with negative size
> Fixes: momo_trip-poc/input
>
> Reported-by: Momoko Shiraishi <shiraishi@os.is.s.u-tokyo.ac.jp>
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
>
>
> >From 3924caed9dd6345bcfa5ce09e9dbc8d5403a7525 Mon Sep 17 00:00:00 2001
> From: Michael Niedermayer <michael@niedermayer.cc>
> Date: Fri, 24 Oct 2025 20:29:23 +0200
> Subject: [PATCH] avformat/rtpenc_h264_hevc: Check space for
> nal_length_size in
> ff_rtp_send_h264_hevc()
>
> Fixes: memcpy with negative size
> Fixes: momo_trip-poc/input
>
> Reported-by: Momoko Shiraishi <shiraishi@os.is.s.u-tokyo.ac.jp>
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavformat/rtpenc_h264_hevc.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/libavformat/rtpenc_h264_hevc.c
> b/libavformat/rtpenc_h264_hevc.c
> index 4d222dca75..ea19cb0627 100644
> --- a/libavformat/rtpenc_h264_hevc.c
> +++ b/libavformat/rtpenc_h264_hevc.c
> @@ -196,6 +196,8 @@ void ff_rtp_send_h264_hevc(AVFormatContext *s1, const
> uint8_t *buf1, int size)
> r1 = ff_nal_mp4_find_startcode(r, end, s->nal_length_size);
> if (!r1)
> r1 = end;
> + if (r1 - r < s->nal_length_size)
> + break;
> r += s->nal_length_size;
> } else {
> while (!*(r++));
> --
> 2.49.1
>
Is this not a bug in ff_nal_mp4_find_startcode?
If not, please add a comment as to the reason this condition happens.
Kieran
>
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
^ permalink raw reply [flat|nested] 3+ messages in thread* [FFmpeg-devel] Re: [PATCH] avformat/rtpenc_h264_hevc: Check space for nal_length_size in ff_rtp_send_h264_hevc() (PR #20746)
2025-10-24 22:03 ` [FFmpeg-devel] " Kieran Kunhya via ffmpeg-devel
@ 2025-10-25 22:50 ` Michael Niedermayer via ffmpeg-devel
0 siblings, 0 replies; 3+ messages in thread
From: Michael Niedermayer via ffmpeg-devel @ 2025-10-25 22:50 UTC (permalink / raw)
To: FFmpeg development discussions and patches; +Cc: Michael Niedermayer
[-- Attachment #1.1: Type: text/plain, Size: 2402 bytes --]
On Fri, Oct 24, 2025 at 06:03:26PM -0400, Kieran Kunhya via ffmpeg-devel wrote:
> On Fri, 24 Oct 2025, 14:52 michaelni via ffmpeg-devel, <
> ffmpeg-devel@ffmpeg.org> wrote:
>
> > PR #20746 opened by michaelni
> > URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746
> > Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746.patch
> >
> > Fixes: memcpy with negative size
> > Fixes: momo_trip-poc/input
> >
> > Reported-by: Momoko Shiraishi <shiraishi@os.is.s.u-tokyo.ac.jp>
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> >
> >
> > >From 3924caed9dd6345bcfa5ce09e9dbc8d5403a7525 Mon Sep 17 00:00:00 2001
> > From: Michael Niedermayer <michael@niedermayer.cc>
> > Date: Fri, 24 Oct 2025 20:29:23 +0200
> > Subject: [PATCH] avformat/rtpenc_h264_hevc: Check space for
> > nal_length_size in
> > ff_rtp_send_h264_hevc()
> >
> > Fixes: memcpy with negative size
> > Fixes: momo_trip-poc/input
> >
> > Reported-by: Momoko Shiraishi <shiraishi@os.is.s.u-tokyo.ac.jp>
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> > libavformat/rtpenc_h264_hevc.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/libavformat/rtpenc_h264_hevc.c
> > b/libavformat/rtpenc_h264_hevc.c
> > index 4d222dca75..ea19cb0627 100644
> > --- a/libavformat/rtpenc_h264_hevc.c
> > +++ b/libavformat/rtpenc_h264_hevc.c
> > @@ -196,6 +196,8 @@ void ff_rtp_send_h264_hevc(AVFormatContext *s1, const
> > uint8_t *buf1, int size)
> > r1 = ff_nal_mp4_find_startcode(r, end, s->nal_length_size);
> > if (!r1)
> > r1 = end;
> > + if (r1 - r < s->nal_length_size)
> > + break;
> > r += s->nal_length_size;
> > } else {
> > while (!*(r++));
> > --
> > 2.49.1
> >
>
> Is this not a bug in ff_nal_mp4_find_startcode?
>
> If not, please add a comment as to the reason this condition happens.
added, not sure how usefull that is though.
Its simply that the last is truncated ff_nal_mp4_find_startcode() returns NULL
which is turned into end and then theres just not enough space for nal_length_size
thx
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
it is not once nor twice but times without number that the same ideas make
their appearance in the world. -- Aristotle
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 163 bytes --]
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-10-25 22:51 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-10-24 18:52 [FFmpeg-devel] [PATCH] avformat/rtpenc_h264_hevc: Check space for nal_length_size in ff_rtp_send_h264_hevc() (PR #20746) michaelni via ffmpeg-devel
2025-10-24 22:03 ` [FFmpeg-devel] " Kieran Kunhya via ffmpeg-devel
2025-10-25 22:50 ` Michael Niedermayer via ffmpeg-devel
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git