From bb310f6044feee495f634fe1afcbb8434b02eacf Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 6 Oct 2026 23:54:53 +0200 Subject: [PATCH] avformat/mxfenc: Fail on invalid FFV1 versions instead of asserting Fixes: assertion failure Fixes: NwEesUvc9OLL Assertion failure Replicated through UnModified FFmpeg Assertion failure on extradata Replicated through API Found during triage of the security report AISLE-2026-0111-00534 --- libavformat/mxfenc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavformat/mxfenc.c b/libavformat/mxfenc.c index 37b62dbd2b..f3a054d933 100644 --- a/libavformat/mxfenc.c +++ b/libavformat/mxfenc.c @@ -2676,8 +2676,7 @@ static int mxf_parse_ffv1_frame(AVFormatContext *s, AVStream *st, AVPacket *pkt) ff_init_range_decoder(&c, st->codecpar->extradata, st->codecpar->extradata_size); ff_build_rac_states(&c, 0.05 * (1LL << 32), 256 - 8); v = get_ffv1_unsigned_symbol(&c, state); - av_assert0(v >= 2); - if (v > 4) { + if (v < 2 || v > 4) { av_log(s, AV_LOG_ERROR, "unsupported ffv1 version %d\n", v); return 0; } @@ -2688,7 +2687,8 @@ static int mxf_parse_ffv1_frame(AVFormatContext *s, AVStream *st, AVPacket *pkt) ff_build_rac_states(&c, 0.05 * (1LL << 32), 256 - 8); get_rac(&c, &keystate); // keyframe v = get_ffv1_unsigned_symbol(&c, state); - av_assert0(v < 2); + if (v >= 2) + return 0; } sc->codec_ul = &mxf_ffv1_codec_uls[v]; sc->sub_descriptor = FFV1SubDescriptor;