Without setting this flag, apparently gnutls will only send the client
certificate according some logic based on what it thinks the server
accepts.
This is not the case a lot of times.
Just force it to send the client cert the user supplied, if one was
supplied, no matter what.
Fixes#22707
(cherry picked from commit 5c35d0b880)
Regression since dc4c798970
Handle the case where mp4 is disabled since mp4 as
an optional dependency of hls_muxer.
Signed-off-by: Jack Lau <jacklau1222gm@gmail.com>
(cherry picked from commit 0510aff11b)
Technically it's is UB to call function of different type.
Fixes:
src/libavformat/utils.c:531:9: runtime error: call to function handle_variant_args through pointer to incorrect function type 'void (*)(void *, const char *, int, char **, int *)'
src/libavformat/hls.c:379: note: handle_variant_args defined here
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit d768bd564e)
Parse the timestamp with av_small_strptime() instead of sscanf(): it
range-checks each field (year 0-9999, month, day, hour, minute, second)
and limits the number of digits consumed, so an oversized field can no
longer overflow during parsing. The mktime() result is additionally
checked for EOVERFLOW.
Fixes: integer overflow
Found-by: Kery (Qi Kery <qikeyu2001@outlook.com>)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c82196b299)
Otherwise, this might leak stale bytes that were already drained by the
HTTP soft-seek attempt.
Sponsored-by: nxtedition AB
Signed-off-by: Niklas Haas <git@haasn.dev>
(cherry picked from commit 0d0f9a06ab)
Otherwise this could leak stale values from a previous response.
Sponsored-by: nxtedition AB
Signed-off-by: Niklas Haas <git@haasn.dev>
(cherry picked from commit 8712114200)
When get_bits_left() returns a negative value (bitstream reader already past the end of the buffer), the while condition while (get_bits_left(gb)) evaluates to true since any non-zero int is truthy.
With the safe bitstream reader enabled, get_bits1() returns 0 past the buffer end, so the break never triggers and leading_zeros increments toward INT_MAX.
Change the condition to > 0, consistent with skip_1stop_8data_bits() which already uses <= 0 for the same pattern.
Signed-off-by: Linke <1102336121@qq.com>
(cherry picked from commit e44d76f61f)
The return value of MoveFileExW was not being correctly interpreted,
see https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-movefileexw.
On Windows a failed rename over the file: protocol now surfaces as failed to rename file %s to %s:
Operation not permitted (ff_rename, libavformat/avio.c:867) plus an AVERROR(EPERM) return, where previously the muxer
reported success and the user was left with a missing or stale output file and no diagnostic. This affects the
write-to-temp-then-rename paths in hlsenc, dashenc, hdsenc, smoothstreamingenc, segment, and img2enc (e.g. HLS/DASH
playlist updates, -write_temp_file, segment list finalization).
Also, added unit tests to exercise the rename function.
Signed-off-by: Christopher Decker <chris.decker08@gmail.com>
(cherry picked from commit 94ff335d76)
Co-Authored-by: Fable 5
fix issue: issues/23057 POC4
In refresh_manifest(), when timelines are present, fragment_timescale is
used as the denominator to compute currentTime. If fragment_timescale is
zero (e.g., timescale attribute missing from a crafted manifest with
SegmentTimeline), this results in a division by zero.
Add fragment_timescale > 0 guard to both the video and audio timeline
processing paths to prevent the crash.
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 6a351a3113)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
the genh demuxer had the same short-read issue at one location. the read is now performed with `ffio_read_size()` so truncated input is rejected instead of leaving uninitialized data in the extradata.
`ff_alloc_extradata()` also had its return value unchecked. if allocation failed, the code could dereference a null pointer. the return value is now checked.
the affected path is capped at two channels, so the potential information leak is relatively small, but it is the same underlying bug class.
Signed-off-by: unfunnyatearug <yalisib2222@gmail.com>
(cherry picked from commit 4b47405e1c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
In buf_realloc, os->bufsize is unsigned int and the code doubles it:
nb = av_realloc(os->buf, 2*os->bufsize + AV_INPUT_BUFFER_PADDING_SIZE);
When os->bufsize exceeds UINT_MAX/2, the multiplication overflows
to a small value, av_realloc returns a tiny buffer, and the subsequent
page write in ogg_read_page goes out of bounds.
Reject the reallocation before the overflow can occur. The largest
safe value is (UINT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 2.
Signed-off-by: age5000 <age5000@proton.me>
(cherry picked from commit d7d119bbe2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
mov_read_keys() allocated (count + 1) pointers from the 32 bit entry
count of the keys atom before reading a single key record, so a 56 byte
file declaring 16777216 keys made ffprobe allocate and zero 128 MiB.
Every key record takes at least 8 bytes, so a count above atom.size / 8
cannot be satisfied and is rejected before the allocation.
Fixes: unbounded allocation
Fixes: poc-keys-count-16777216.mp4
Fixes: hKO4f7GYoUd0
Found-by: He Huang, discovery assisted by NexusSan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 67926e6667)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
For IP-literal hosts mbedtls_ssl_set_hostname() was skipped, so a
CA-trusted certificate for an unrelated name was accepted with no CN/SAN
check. Set the name for numeric hosts too; mbedTLS matches IP literals
against iPAddress SANs.
Fixes: certificate host mismatch accepted for IP-literal hosts (CWE-297)
Fixes: oLS26nsaOqUr
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 57a2e704b4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
vpk_read_packet() divides last_block_size and block_align by
codecpar->ch_layout.nb_channels when assembling the last interleaved
block. Header parsing already rejects a non-positive channel count,
but a failed avcodec_open2() can later zero the layout through
ff_codec_close() -> av_opt_free(), so the division is reached with a
zero divisor.
Check the channel count again before dividing and return
AVERROR_INVALIDDATA.
Original-patch-by: Kacper Michajłow <kasper93@gmail.com>
Fixes: #24290
Reported-by: Darío Clavijo
Found-by: OSS-Fuzz
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
(cherry picked from commit 780f6efbcf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
avformat_find_stream_info() copies codec parameters from the decoder
context after probing, including when avcodec_open2() has already
failed. A failed avcodec_open2() zeroes the context channel layout via
ff_codec_close() -> av_opt_free(), because ch_layout is an
AV_OPT_TYPE_CHLAYOUT option. That empty layout is then written back
onto codecpar and replaces the value the demuxer had already set from
the container.
This is reachable for codecs such as adpcm_psx that have no parser and
do not set AVSTREAM_PARSE_*: the only source of the channel count is
the demuxer header. It differs from codecs like mp3, where the decoder
is expected to fill the layout.
Restore the container channel layout when it was specified and the
decoder result is unspecified, matching the existing restore of color
metadata in parameters_from_context().
See also:
https://ffmpeg.org/pipermail/ffmpeg-devel/2024-November/335598.htmlFixes: #24290
Fixes: https://issues.oss-fuzz.com/issues/42536474
Reported-by: Darío Clavijo
Found-by: OSS-Fuzz
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
(cherry picked from commit fd6dc624be)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
vmdvideo_decode_init() loads a 768 byte VGA palette from header offset
28 and scales each entry by 4, so every one of these bytes is 6bit in a
file that carries a video stream. Rejecting a larger value keeps raw
video from being mistaken for VMD: a yuv420p10le file starting with
0x2e 0x03 matches the header size field and then scores the same 50 as
the rawvideo demuxer picked by the .yuv extension, which leaves the
format undetermined and fails the whole conversion.
The 26 files with a video stream on samples.ffmpeg.org/game-formats/
sierra-vmd/ all pass; the 9 audio only ones there hold unrelated data
at offset 28 and are exempted by the width and height test.
Fixes: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/22284
(cherry picked from commit 905ef92f02)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
binka_read_packet() calls avio_read() into a buffer from av_new_packet()
and ignores the return value. packet_alloc() only zeroes the 64-byte
padding; the payload is left uninitialized.
pkt_size is avio_rl16() + 4 (max 65539). On a truncated file the demuxer
still returns 0, so av_read_frame delivers up to 64 KiB of uninitialized
heap per packet. ffmpeg -c copy writes those bytes into the output.
Use ffio_read_size() so a short read fails the packet with
AVERROR_INVALIDDATA. Same class as 29f513a (fsb) and 4b47405 (genh).
Signed-off-by: Paulo Cabral Sanz <paulosanz@poli.ufrj.br>
(cherry picked from commit c2394a0ff3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Don't use values that would extend emum data size.
Fixes: warning: enumerator value which exceeds the range of 'int' is a
C23 extension (2147483648 is too large)
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit e7b9c5fe77)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: read of uninitialized memory
Fixes: PJaSVrRTt6Kf
Found-by: Eunsoo Kim, Microsoft FORGE Labs
(cherry picked from commit 73130e77dc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: eYvYXUJZbPJ
Regression since: bca30570d2
Found-by: Eunsoo Kim, Microsoft FORGE Labs
(cherry picked from commit c42ac5c566)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(long)obu_size sign-flips values in 0x80000000..0xfffffffd on ILP32/LLP64
targets (32-bit long, e.g. 64-bit Windows), bypassing the size check.
Compare as uint32_t; frame_size is non-negative at this point.
No PoC as the used setup was 64bit specific
(cherry picked from commit b4c199c590)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The is_keyframe sequence-header search loop advanced buf_ptr/rem_size by
num_lebs + obu_size without bounding obu_size against the remaining data
(unlike the main packetization loop). A crafted obu_size (~0x80000010)
wraps the signed rem_size back positive, so the next iteration
dereferences a pointer past the packet. Consume the LEB bytes first, then
reject an OBU larger than the remaining size. Out-of-bounds read reachable
from a crafted AV1 packet muxed to RTP.
Fixes: out of array read
(cherry picked from commit 983dae9c19)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
send_packet() copied an input-derived unit/fragment size into the fixed
rtp_ctx->buf with no bound, overflowing it for a crafted Dirac unit even at
the default packet size. Reject units that do not fit in max_payload_size.
Fixes: out of array access
(cherry picked from commit 1cdeb3c4e7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
A live manifest whose startNumber decreases across a refresh drives
cur_seq_no negative in move_segments(); get_current_fragment() only checked
the upper bound before indexing fragments[]. Add a lower-bound check and
clamp the negative delta at its source.
Fixes: out of array read
(cherry picked from commit 65b0dab903)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
numNalus is uint16_t; a crafted hvcC declaring >65535 NAL units of one
type wraps it to 0 and then writes nal[-1]. Reject before the count can
wrap. Reachable by remuxing a crafted file with -c copy.
Fixes: integer overflow
Fixes: out of array access
(cherry picked from commit acf5d7cdc1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
put_system_header() writes 12 + 3*N bytes after the pack header into a
fixed 128-byte stack buffer, but is handed a PutBitContext sized past the
real buffer, so its own bounds check never fires; ~35+ streams overflow the
stack. Reject at mux init when the system header would not fit.
Fixes: out of array access
Fixes: many.mkv
(cherry picked from commit 9d786e4b5e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
librist_read() ignored its size argument and copied the full payload_len,
overflowing a smaller destination (e.g. via the async: wrapper). Clamp the
copy to the caller-provided buffer size.
Fixes: out of array access
(cherry picked from commit 1c10bcc2e1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
A zero channel count can cause a division by zero in
scd_read_packet().
Reported-by: sdjasj
Fixes#23181.
Signed-off-by: qaq03101 <1440810736@qq.com>
(cherry picked from commit 9c176644aa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
fix issue: issues/23057 POC1
release seg memory and return NULL if av_strtok return NULL.
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 813c28d1ce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
When computing the segment count for a SegmentTimeline entry with
repeat="-1" (indefinite repeat, typical for live streams), the
expression:
length_of_each_segment = pls->timelines[i]->duration /
pls->fragment_timescale;
num = c->period_duration / length_of_each_segment;
performs two successive integer divisions. The first division
truncates toward zero; if the segment duration in timescale ticks
is smaller than the timescale (duration < fragment_timescale),
length_of_each_segment becomes 0, and the second division triggers
a division by zero.
Fix this by using av_rescale(), which computes
period_duration * fragment_timescale / duration
with 64-bit intermediate precision, avoiding both the truncation
and the zero-division risk. If duration is 0 (invalid manifest),
explicitly fall back to first_seq_no instead of crashing.
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 0c0dd61b8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
