From 58d39e99e26d1116f43a67d66ecfe71dba316875 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 7 Jul 2025 02:53:18 +0200
Subject: [PATCH] avformat/concatdec: Check recursion depth

This variant is easy backportable but is concatdec specific

Fixes: self_ref.ffconcat
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Rediscovered-by: Anxious Koisi
Fixes: RWHkT0ASFMNI
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/concatdec.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/libavformat/concatdec.c b/libavformat/concatdec.c
index c57d1b649a..665b4e3e66 100644
--- a/libavformat/concatdec.c
+++ b/libavformat/concatdec.c
@@ -73,6 +73,7 @@ typedef struct {
     ConcatMatchMode stream_match_mode;
     unsigned auto_convert;
     int segment_time_metadata;
+    int recursion_depth;
 } ConcatContext;
 
 static int concat_probe(const AVProbeData *probe)
@@ -357,6 +358,12 @@ static int open_file(AVFormatContext *avf, unsigned fileno)
     if (ret < 0)
         return ret;
 
+    ret = av_dict_set_int(&options, "recursion_depth", cat->recursion_depth - 1, 0);
+    if (ret < 0) {
+        av_dict_free(&options);
+        return ret;
+    }
+
     if ((ret = avformat_open_input(&cat->avf, file->url, NULL, &options)) < 0 ||
         (ret = avformat_find_stream_info(cat->avf, NULL)) < 0) {
         av_log(avf, AV_LOG_ERROR, "Impossible to open '%s'\n", file->url);
@@ -364,6 +371,7 @@ static int open_file(AVFormatContext *avf, unsigned fileno)
         avformat_close_input(&cat->avf);
         return ret;
     }
+    av_dict_set(&options, "recursion_depth", NULL, 0);
     if (options) {
         av_log(avf, AV_LOG_WARNING, "Unused options for '%s'.\n", file->url);
         /* TODO log unused options once we have a proper string API */
@@ -665,6 +673,11 @@ static int concat_read_header(AVFormatContext *avf)
     unsigned i;
     int ret;
 
+    if (cat->recursion_depth <= 0) {
+        av_log(avf, AV_LOG_ERROR, "Too deep recursion\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     ret = concat_parse_script(avf);
     if (ret < 0)
         return ret;
@@ -940,6 +953,8 @@ static const AVOption options[] = {
       OFFSET(auto_convert), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, DEC },
     { "segment_time_metadata", "output file segment start time and duration as packet metadata",
       OFFSET(segment_time_metadata), AV_OPT_TYPE_BOOL, {.i64 = 0}, 0, 1, DEC },
+    { "recursion_depth", "max recursion depth",
+      OFFSET(recursion_depth), AV_OPT_TYPE_INT, {.i64 = 10}, 0, INT_MAX, DEC },
     { NULL }
 };