dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-24 08:48:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

lavf/movenc: fix missing padding for AV1 extradata

Browse Source 
The extradata allocated in mov_write_single_packet() for AV1 was missing
the required AV_INPUT_BUFFER_PADDING_SIZE padding bytes. This could lead
to out-of-bounds reads when the extradata is parsed by bitstream readers.

Replace av_memdup() with av_malloc() + memset() + memcpy() to ensure
proper padding is present and zeroed.

Reproduced with:
./ffmpeg -y -f lavfi -i "testsrc=duration=1:size=320x240:rate=30" -c:v libaom-av1 -cpu-used 8 -crf 50 test-av1.mp4

Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
(cherry picked from commit 6c878f8b82)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Jun Zhao
2026-01-05 21:47:22 +08:00
committed by Michael Niedermayer
parent 55da57f723
commit 7386406b10
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libavformat/movenc.c
View File

@@ -7119,9 +7119,11 @@ static int mov_write_single_packet(AVFormatContext *s, AVPacket *pkt)
uint8_t *side = av_packet_get_side_data(pkt, AV_PKT_DATA_NEW_EXTRADATA, &side_size);
/* Overwrite extradata only on flush packets or when no extradata was available during init */
if (side_size > 0 && (!pkt->size || !trk->extradata_size[trk->last_stsd_index])) {
void *newextra = av_memdup(side, side_size);
void *newextra = av_malloc(side_size + AV_INPUT_BUFFER_PADDING_SIZE);
if (!newextra)
return AVERROR(ENOMEM);
memset((uint8_t*)newextra + side_size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
memcpy(newextra, side, side_size);
av_free(trk->extradata[trk->last_stsd_index]);
trk->extradata[trk->last_stsd_index] = newextra;
trk->extradata_size[trk->last_stsd_index] = side_size;