From 94c3187ef7384735b2902abb34a95cbe2400a159 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 6 Oct 2026 23:17:58 +0200 Subject: [PATCH] avformat/mmst: Fail when the ASF header has no packet size or no streams The fix is the one recommended in the report. Fixes: NULL pointer dereference Fixes: 1eA5JUo2ED6K Fixes: AISLE-2026-0111-00154 NULL pointer dereference Replicated through UnModified FFmpeg with ASAN,UBSAN Found-by: Joshua Rogers --- libavformat/mmst.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/mmst.c b/libavformat/mmst.c index 59d3f9726e..78296a1f26 100644 --- a/libavformat/mmst.c +++ b/libavformat/mmst.c @@ -567,8 +567,10 @@ static int mms_open(URLContext *h, const char *uri, int flags) } mms->header_parsed = 1; - if (!mms->asf_packet_len || !mms->stream_num) + if (!mms->asf_packet_len || !mms->stream_num) { + err = AVERROR_INVALIDDATA; goto fail; + } clear_stream_buffers(mms); err = mms_safe_send_recv(mmst, send_stream_selection_request, SC_PKT_STREAM_ID_ACCEPTED);