Moving the read after the checks was suggested in the report.
Hardening for R5y4vDJ078Lr (AISLE-2026-0111-00004)
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
Fixes: 3Fn44aM2tqIx
Fixes: infinite loop
Infinite loop Replicated through UnModified FFmpeg with a nonblocking pipe and timeout
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24909
Fixes: FJdNqUYeEkPS
Fixes: wrong event text
Fixes: out of array read
Wrong event text Replicated through UnModified FFmpeg with plain output diff
Out of array read Replicated through API with ASAN
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24659
Found-by: Marton Balint <cus@passwd.hu>
Suggested-by: Marton Balint <cus@passwd.hu>
This is not a security issue.
Not replicated, compile tested only (mbedtls 3.6.2).
Fixes: T7EtPuJBKWqg
Fixes: swarm-Memory-leak-early-return-skips-mbedtls-resource-cleanup-a1d295
Found-by: zhang xingxing <2388969553@qq.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This is not a security issue.
Fixes: ORPoDnVi3BLg
Fixes: swarm-MD5-context-leaked-when-output-URL-open-fails-e4415f
Found-by: zhang xingxing <2388969553@qq.com>
Memory leak Replicated through UnModified FFmpeg with LSAN
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The existing warning does not distinguish a forward timestamp outside the
Block's signed 16-bit range from a late packet that forces a backward
Cluster timestamp jump. Include the direction, stream index, incoming
timestamp, current Cluster timestamp and signed difference in milliseconds.
This addresses the diagnostic part of issue #24379. It does not change
packet interleaving or turn the condition into a muxing error.
Assisted-by: Fairy
Fixes: signed integer overflow
Fixes: 2PuIAHF3wU0b
Regression since: e27ad5760c
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24873
Signed integer overflow Replicated through UnModified FFmpeg with UBSAN
Fixes: signed integer overflow
Fixes: CniIhjP8pfgr
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24873
Signed integer overflow Replicated through UnModified FFmpeg with UBSAN
Fixes: signed integer overflow
Fixes: 5NVcwD9UoHmO
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24878
Signed integer overflow Replicated through UnModified FFmpeg with UBSAN
Fixes: heap-buffer-overflow
Fixes: negative-size-param
Fixes: infinite loop
Fixes: hnrHe6JoiDya
Out of array write, negative-size memcpy and endless loop Replicated through UnModified FFmpeg with ASAN
Found during triage of the security report TwYfznAFyatl (#22717), the
JPEG case is mentioned in the discussion of the issue
Fixes: heap-buffer-overflow
Fixes: sbHrRrZhcbbZ
Out of array write Replicated through UnModified FFmpeg with ASAN
Found during triage of the security report TwYfznAFyatl (#22717)
Fixes: heap-buffer-overflow
Fixes: zZoxZuoiTRhn
Out of array write Replicated through UnModified FFmpeg with ASAN
Found during triage of the security report TwYfznAFyatl (#22717)
Fixes: heap-buffer-overflow
Fixes: FyS11JI5UXC7
Fixes: ffmpeg -i fate-suite/av1/film_grain.ivf -frames:v 2 -c copy -strict experimental -f rtp -packetsize 13 /dev/null
Out of array read Replicated through UnModified FFmpeg with ASAN
Found during triage of the security report TwYfznAFyatl (#22717)
Fixes: negative-size-param
Fixes: infinite loop
Fixes: KX3pF2MSORSh
Fixes: ffmpeg -f lavfi -i sine=d=0.2 -c:a mp2 -f rtp -packetsize 13 /dev/null
Negative-size memcpy and endless loop Replicated through UnModified FFmpeg with ASAN
Found during triage of the security report TwYfznAFyatl (#22717)
Stream desynchronization Replicated through UnModified FFmpeg
Found during review of the fixes for the security report yyLBi9GsHV9w
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: WoBBcuySgSTx
Fixes: swarm-sctp_read-returns-2-on-graceful-close-never-signalling-EOF-2a7ba0
Endless loop Replicated through UnModified FFmpeg
Found-by: zhang xingxing <2388969553@qq.com>
The report suggested not adding the stream id size when recvmsg() returns 0.
The case without max_streams was found during triage of the report.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The RoQ player in the Quake III Arena source (code/client/cl_cin.c) also
continues after the declared size of every RoQ_INFO chunk.
Fixes: yyLBi9GsHV9w
Fixes: swarm-RoQ_INFO-re-entry-skips-fixed-size-ignoring-chunk_size-e7709a
Stream desynchronization Replicated through UnModified FFmpeg
Found-by: zhang xingxing <2388969553@qq.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
AV_CODEC_ID_TEXT packets are written as an AMF0 string, whose length is a
16-bit field. For text over 65535 bytes the length wrapped (e.g. 4464 for
70000 bytes) while the whole text was written, so readers misparse the
onTextData tag.
Fail on such packets before writing the tag.
Found while reviewing the metadata length fix for FLV.
Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>
asf_o is a second, non-default implementation of the ASF demuxer next
to asfdec_f.c. Security issues keep being reported against it, so it
is a maintenance burden without a benefit over the default demuxer.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: heap-use-after-free
Fixes: GXcHU0CpqXBk
Fixes: ANT-2026-5PRHEUWY
Found-by: Anthropic agents; validated and reported by Ada Logics.
Suggested-by: James Almer <jamrial@gmail.com>
Fixes issue due to MXF muxer writing FFV1Version by copying byte 14 of the FFV1 codec label.
This caused incorrect version numbers, it would increase by one, so 3 became 4.
Now we save the real version in sc->version.
The fcTL and fdAT chunks share a single sequence number, which must start
at 0 and increase by one for every chunk, with no gap and no duplicate.
Report the chunks which do not follow it, resynchronizing on the value
which was read so that the following chunks are not reported as well.
Out of order chunks are only reported and not rejected, so that files
written by encoders getting this wrong are still played.
Validate fdAT lengths and complete reads before locating the sequence
number in the packet. Resynchronize after external seeks, where the next
sequence number cannot be inferred from the previously read frame.
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
This is not a security issue.
Fixes: d9RoImPBG3x8
Fixes: swarm-NULL-q1-passed-to-bn_modexp-when-GMP-MbedTLS-alloc-fails-c4db13
Regression since: 78efc69e7c (GMP), 62f5c9d68b (mbedTLS)
NULL bignum passed to bn_modexp() Replicated through Modified FFmpeg with ASAN (GMP and mbedTLS builds, the q1 allocation in ff_dh_generate_public_key() made to fail)
Found-by: zhang xingxing <2388969553@qq.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This is not a security issue.
Fixes: 6lFLlG49gRxf
Fixes: swarm-NULL-pointer-dereference-via-snprintf-s-with-NULL-nonce-83e8f3
Regression since: c1ea44c54d
NULL nonce passed to snprintf() Replicated through UnModified FFmpeg with a local RTMP server (the reconnect carried nonce=(null))
Found-by: zhang xingxing <2388969553@qq.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This is not a security issue.
Fixes: yehJZZYu2sOZ
Fixes: swarm-JNI-resource-leak-on-fstat-failure-in-android_content_open-e505e3
Found-by: zhang xingxing <2388969553@qq.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This is not a security issue.
Fixes: GJrBZmxJqqm8
Fixes: swarm-Integer-truncation-of-parsed-duration-and-timestamps-1a4b12
Found-by: zhang xingxing <2388969553@qq.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This is not a security issue.
Regression since: 8665748584
Fixes: usWfwH9F2jUN
Fixes: swarm-Inverted-comparison-in-subblock_duration-validation-6190ea
Found-by: zhang xingxing <2388969553@qq.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Exclude IMM6 from one-in/one-out timestamp inference so AVI probing
does not assign PTS from DTS before the H.264 reordering delay is known.
Signed-off-by: Tom Needham <06needhamt@gmail.com>
A directory listing that blocks in a protocol could not be
interrupted; avio_open_dir2() passes an interrupt callback to the
protocol like avio_open2() does.
Assisted-by: Claude
ffurl_read() reports the end of the data with AVERROR_EOF, which
ftp_read_dir() passed on as an error instead of ending the listing.
Fixes: avio_list_dir on a directory served by pyftpdlib 2.0.1
Assisted-by: Claude
A server that finds the data connection open when it receives MLSD
replies with 125 instead of 150, which left ftp_status() waiting for
a further reply until the server dropped the control connection.
Reply code 125 is accepted for RETR and STOR already.
Fixes: avio_list_dir on a directory served by pyftpdlib 2.0.1
Assisted-by: Claude
The rx and tx threads no longer use pthread_cancel(), so gate the
circular buffer on HAVE_THREADS instead of HAVE_PTHREAD_CANCEL. This
also drops the w32threads override.
On targets that have threads but no pthread_cancel(), such as Android,
udp inputs now start a receive thread and allocate the default 7*4096
by 188 byte fifo, as on other platforms. Set fifo_size=0 to get the
previous behavior.
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
The rx thread blocks in recvfrom() and udp_close() cancelled it. That
only works if recvfrom() is a cancellation point and if a cancel
request made while cancellation is disabled is still acted on later.
Darwin loses such a request, so closing an input that is receiving
data hangs in pthread_join(). On Win32 recvfrom() is not a
cancellation point at all, which is why udp_close() needed a separate
shutdown() and CancelIoEx() path.
Wait with ff_network_wait_fd() instead, as other protocols do. Closing
an input that receives no data can take up to POLLING_TIME.
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
sap_fetch_packet() polls the raw socket fd to find pending
announcements and reads them itself to detect stream deletion. With
the circular buffer enabled, the rx thread competes for the same
datagrams and usually reads them first, so poll() seldom reports
POLLIN and the check becomes unreliable.
Pass fifo_size=0 as rtpproto.c does.
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
