Cover ID3v2.3 and ID3v2.4 with a chapter title long enough that a plain
size and a synchsafe size differ. Print the CHAP size bytes, declared and
actual tag lengths, chapter counts, titles and timings for FATE to compare
against its reference output.
Also give the first embedded text frame an oversized length and verify
through the reference that both chapters and their timings survive.
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
ID3v2.3 stores a frame size as a plain 32-bit integer. ID3v2.4 stores it
as a synchsafe integer. write_chapter() always wrote the plain form, and
read_chapter() always read it that way. Once an embedded text frame
reached 128 bytes, the size no longer fitted and the chapter was dropped.
Write the CHAP header with the same version rule as other frames. Read an
embedded frame with that rule, and keep the chapter when a subframe size
does not fit.
Fixes: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/25357
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
EXT-X-START may appear in both Master and Media Playlists (RFC 8216
4.3.5.2). Parsing it allocated a Media Playlist, so a Master Playlist
carrying it before its EXT-X-STREAM-INF entries was rejected since
0e6eef3551.
Record the offset while parsing and apply it once the playlist type is
known. A value from a Master Playlist applies to all its Media
Playlists, which then ignore their own, as RFC 8216 4.3.5 recommends.
Defer EXT-X-ENDLIST the same way, so that it is not lost when it
precedes the first tag allocating the Media Playlist.
Parse a playlist, then optionally a Media Playlist into the first
playlist it declared, as hls_read_header() does, and print the parsed
playlists with their finished state and EXT-X-START offset.
If the pixel format is a hardware one, components will be unset, and we will
end up writing an invalid pixi box.
Signed-off-by: James Almer <jamrial@gmail.com>
The lookup of the stream group for each IAMF audio element compared only
the group id and kept the last match. Mix presentation groups are created
after the audio element groups and use the mix_presentation_id as their
id, so if a mix_presentation_id equals an audio_element_id the mix
presentation group was picked instead. Its entries are the streams of
every audio element, so the same output stream got its index entries
filled twice and the av_assert0(!out_sti->index_entries) aborted.
Such files are written by FFmpeg's own mp4 muxer, e.g. with two audio
elements with ids 1 and 2 and a mix presentation with id 1.
Also check the group type. Keep using the last match: audio element ids
are only unique within one IAMF track, and the groups of the current
track were just appended, so the last match is the audio element of the
current track even if an earlier track uses the same id.
Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>
mpegts_raw_read_packet() with compute_pcr looks ahead up to
MAX_PACKET_READAHEAD packets for the next PCR, reading 12 bytes of
each candidate into a stack buffer with avio_read() and ignoring the
return value. When the lookahead runs past the end of the file the
buffer keeps whatever it held, uninitialised on the first iteration,
and parse_pcr() is run on it. If those bytes happen to look like a
PCR, the garbage difference becomes pcr_incr and is published as the
duration of this packet and the pts of every later one. On a build
with -ftrivial-auto-var-init=pattern a file ending in a partial
packet yields duration=1716393918470 instead of 27000000.
Stop the readahead when the seek or the read fails. The packet itself
was already read successfully, and the "no next PCR found" fallback
to the previous increment is the designed behaviour for this case, so
failing the packet would be wrong.
Same class as c2394a0ff3 (binka), 29f513af78 (fsb), 4b47405e1c (genh).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: StressTestor <212606152+StressTestor@users.noreply.github.com>
get_tag() reads a 16-byte GUID attribute into a stack buffer with
avio_read() and ignores the return value. On a legacy_attrib entry
that is cut inside the GUID, the 16 bytes are never written and the
uninitialised stack contents are formatted with PRI_PRETTY_GUID and
published as a metadata string; ffprobe prints them as e.g.
"TAG:encoder=aaaaaaaa-aaaa-aaaa-aaaaaaaaaaaaaaaa" on a build with
-ftrivial-auto-var-init=pattern.
Use ff_get_guid(), which reads with ffio_read_size() and fails on a
short read, and return without adding the tag, as get_tag() already
does when a string attribute is empty.
Same class as c2394a0ff3 (binka), 29f513af78 (fsb), 4b47405e1c (genh).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: StressTestor <212606152+StressTestor@users.noreply.github.com>
Unless it's requested by the user's compliant level.
Allows demuxing some seemingly non spec-compliant files in the wild again after
the recent Gain Map support addition.
Signed-off-by: James Almer <jamrial@gmail.com>
Moving the read after the checks was suggested in the report.
Hardening for R5y4vDJ078Lr (AISLE-2026-0111-00004)
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
Fixes: 3Fn44aM2tqIx
Fixes: infinite loop
Infinite loop Replicated through UnModified FFmpeg with a nonblocking pipe and timeout
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24909
Fixes: FJdNqUYeEkPS
Fixes: wrong event text
Fixes: out of array read
Wrong event text Replicated through UnModified FFmpeg with plain output diff
Out of array read Replicated through API with ASAN
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24659
Found-by: Marton Balint <cus@passwd.hu>
Suggested-by: Marton Balint <cus@passwd.hu>
This is not a security issue.
Not replicated, compile tested only (mbedtls 3.6.2).
Fixes: T7EtPuJBKWqg
Fixes: swarm-Memory-leak-early-return-skips-mbedtls-resource-cleanup-a1d295
Found-by: zhang xingxing <2388969553@qq.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This is not a security issue.
Fixes: ORPoDnVi3BLg
Fixes: swarm-MD5-context-leaked-when-output-URL-open-fails-e4415f
Found-by: zhang xingxing <2388969553@qq.com>
Memory leak Replicated through UnModified FFmpeg with LSAN
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The existing warning does not distinguish a forward timestamp outside the
Block's signed 16-bit range from a late packet that forces a backward
Cluster timestamp jump. Include the direction, stream index, incoming
timestamp, current Cluster timestamp and signed difference in milliseconds.
This addresses the diagnostic part of issue #24379. It does not change
packet interleaving or turn the condition into a muxing error.
Assisted-by: Fairy
Fixes: signed integer overflow
Fixes: 2PuIAHF3wU0b
Regression since: e27ad5760c
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24873
Signed integer overflow Replicated through UnModified FFmpeg with UBSAN
Fixes: signed integer overflow
Fixes: CniIhjP8pfgr
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24873
Signed integer overflow Replicated through UnModified FFmpeg with UBSAN
Fixes: signed integer overflow
Fixes: 5NVcwD9UoHmO
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24878
Signed integer overflow Replicated through UnModified FFmpeg with UBSAN
Fixes: heap-buffer-overflow
Fixes: negative-size-param
Fixes: infinite loop
Fixes: hnrHe6JoiDya
Out of array write, negative-size memcpy and endless loop Replicated through UnModified FFmpeg with ASAN
Found during triage of the security report TwYfznAFyatl (#22717), the
JPEG case is mentioned in the discussion of the issue
Fixes: heap-buffer-overflow
Fixes: sbHrRrZhcbbZ
Out of array write Replicated through UnModified FFmpeg with ASAN
Found during triage of the security report TwYfznAFyatl (#22717)
Fixes: heap-buffer-overflow
Fixes: zZoxZuoiTRhn
Out of array write Replicated through UnModified FFmpeg with ASAN
Found during triage of the security report TwYfznAFyatl (#22717)
Fixes: heap-buffer-overflow
Fixes: FyS11JI5UXC7
Fixes: ffmpeg -i fate-suite/av1/film_grain.ivf -frames:v 2 -c copy -strict experimental -f rtp -packetsize 13 /dev/null
Out of array read Replicated through UnModified FFmpeg with ASAN
Found during triage of the security report TwYfznAFyatl (#22717)
Fixes: negative-size-param
Fixes: infinite loop
Fixes: KX3pF2MSORSh
Fixes: ffmpeg -f lavfi -i sine=d=0.2 -c:a mp2 -f rtp -packetsize 13 /dev/null
Negative-size memcpy and endless loop Replicated through UnModified FFmpeg with ASAN
Found during triage of the security report TwYfznAFyatl (#22717)
Stream desynchronization Replicated through UnModified FFmpeg
Found during review of the fixes for the security report yyLBi9GsHV9w
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: WoBBcuySgSTx
Fixes: swarm-sctp_read-returns-2-on-graceful-close-never-signalling-EOF-2a7ba0
Endless loop Replicated through UnModified FFmpeg
Found-by: zhang xingxing <2388969553@qq.com>
The report suggested not adding the stream id size when recvmsg() returns 0.
The case without max_streams was found during triage of the report.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The RoQ player in the Quake III Arena source (code/client/cl_cin.c) also
continues after the declared size of every RoQ_INFO chunk.
Fixes: yyLBi9GsHV9w
Fixes: swarm-RoQ_INFO-re-entry-skips-fixed-size-ignoring-chunk_size-e7709a
Stream desynchronization Replicated through UnModified FFmpeg
Found-by: zhang xingxing <2388969553@qq.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
AV_CODEC_ID_TEXT packets are written as an AMF0 string, whose length is a
16-bit field. For text over 65535 bytes the length wrapped (e.g. 4464 for
70000 bytes) while the whole text was written, so readers misparse the
onTextData tag.
Fail on such packets before writing the tag.
Found while reviewing the metadata length fix for FLV.
Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>
asf_o is a second, non-default implementation of the ASF demuxer next
to asfdec_f.c. Security issues keep being reported against it, so it
is a maintenance burden without a benefit over the default demuxer.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: heap-use-after-free
Fixes: GXcHU0CpqXBk
Fixes: ANT-2026-5PRHEUWY
Found-by: Anthropic agents; validated and reported by Ada Logics.
Suggested-by: James Almer <jamrial@gmail.com>
Fixes issue due to MXF muxer writing FFV1Version by copying byte 14 of the FFV1 codec label.
This caused incorrect version numbers, it would increase by one, so 3 became 4.
Now we save the real version in sc->version.
The fcTL and fdAT chunks share a single sequence number, which must start
at 0 and increase by one for every chunk, with no gap and no duplicate.
Report the chunks which do not follow it, resynchronizing on the value
which was read so that the following chunks are not reported as well.
Out of order chunks are only reported and not rejected, so that files
written by encoders getting this wrong are still played.
Validate fdAT lengths and complete reads before locating the sequence
number in the packet. Resynchronize after external seeks, where the next
sequence number cannot be inferred from the previously read frame.
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
