primary_ref_frame is an index into the seven reference names, but the
code assigned it the reference's DPB slot. The two coincide only while
the reference sits in slot 0; once it rotates to slot 1,
referenceNameSlotIndices[primary_ref_frame] is -1, which is invalid,
and NVIDIA drivers lose the device. Inherited from vaapi_encode_av1,
where the same confusion is harmless as the raw frame header maps
every reference name to the same slot.
Have set_name_slot() return the name it picked and use that.
Fixes#20540.
(cherry picked from commit 0da8f2f4ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
AV_RL32() is unsigned, so a skip_samples value below 528 + 1 wraps around
instead of clamping to zero and is written out as a delay of 4095 samples.
(cherry picked from commit 146e0f7b79)
Signed-off-by: Romain Beauxis <romain.beauxis@gmail.com>
The return value of MoveFileExW was not being correctly interpreted,
see https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-movefileexw.
On Windows a failed rename over the file: protocol now surfaces as failed to rename file %s to %s:
Operation not permitted (ff_rename, libavformat/avio.c:867) plus an AVERROR(EPERM) return, where previously the muxer
reported success and the user was left with a missing or stale output file and no diagnostic. This affects the
write-to-temp-then-rename paths in hlsenc, dashenc, hdsenc, smoothstreamingenc, segment, and img2enc (e.g. HLS/DASH
playlist updates, -write_temp_file, segment list finalization).
Also, added unit tests to exercise the rename function.
Signed-off-by: Christopher Decker <chris.decker08@gmail.com>
(cherry picked from commit 94ff335d76)
Co-Authored-by: Fable 5
The encoded session parameters buffer was never freed, and both
GetEncodedVideoSessionParametersKHR error paths returned err, which
is always 0 at that point, reporting success on failure.
(cherry picked from commit b672ae3905)
Co-Authored-by: Fable 5
When the filter graph is torn down early (e.g. at EOF with -frames:v),
the main thread calls dnn_free_model and destroys the request queue
while async inference threads may still be running. When a detached
thread finishes and tries to push its result back to the destroyed
queue, it triggers a segmentation fault.
Add ff_dnn_wait_requests() to dnn_backend_common which blocks
until all allocated request items (ctx->nireq) have been safely
returned to the request_queue. Call it from dnn_free_model in the
torch, tensorflow, openvino, and onnx backends before destroying the queue.
(cherry picked from commit b52c71e438)
Co-Authored-by: Fable 5
Fixes: use of uninitialized memory
Fixes: tiff_short_deflate_heap_disclosure.tiff
Fixes: 1cRIkpUVMQtn
Found-by: Adrian Junge (vurlo)
(cherry picked from commit 2f234ea34c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
fix issue: issues/23057 POC1
release seg memory and return NULL if av_strtok return NULL.
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 813c28d1ce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
FFMPEG_CONFIGURATION and FFMPEG_VERSION were concatenated into av_log
format strings, so any % in them was interpreted as a conversion
specifier and consumed unrelated varargs, causing undefined behavior
ranging from garbled output to a segfault on `ffmpeg -version`. Pass
both as %s arguments instead.
Fixes issue #23662.
The FFMPEG_CONFIGURATION fix is based on a patch by FinnRG; the
FFMPEG_VERSION case is fixed here as well.
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit 160737cf0d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
When computing the segment count for a SegmentTimeline entry with
repeat="-1" (indefinite repeat, typical for live streams), the
expression:
length_of_each_segment = pls->timelines[i]->duration /
pls->fragment_timescale;
num = c->period_duration / length_of_each_segment;
performs two successive integer divisions. The first division
truncates toward zero; if the segment duration in timescale ticks
is smaller than the timescale (duration < fragment_timescale),
length_of_each_segment becomes 0, and the second division triggers
a division by zero.
Fix this by using av_rescale(), which computes
period_duration * fragment_timescale / duration
with 64-bit intermediate precision, avoiding both the truncation
and the zero-division risk. If duration is 0 (invalid manifest),
explicitly fall back to first_seq_no instead of crashing.
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 0c0dd61b8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
ACAMERA_SCALER_AVAILABLE_STREAM_CONFIGURATIONS metadata is an
int32[n*4] array (one 4-tuple per stream config: format, width,
height, input/output flag). ACameraMetadata_const_entry.count is the
total number of int32_t elements, not the number of tuples. The loop
bound must be count/4 to avoid iterating past the end of the array.
Similarly, ACAMERA_CONTROL_AE_AVAILABLE_TARGET_FPS_RANGES is an
int32[n*2] array (min/max pairs). The loop bound must be count/2.
Without this fix, both loops over-iterate and read heap memory
beyond the metadata array bounds.
Signed-off-by: Mirko Visontai <mirkov@google.com>
(cherry picked from commit 1588bce21b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The current logic would stop demuxing the entire manifest once the first Representation
returned EOF, which could result in plenty of packets from other Representations being
lost.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d9da090b1d)
Based on a patch by Michael Niedermayer
Fixes: unbounded allocation
Fixes: poc_output_mix_config_dos.iamf
Fixes: 387qWpjUgeKH
Found-by: Duong Tran Thai (CyStack)
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d2476bfd2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: poc_vvc_vps.266
Fixes: 1z6RugPwxp39
Found-by: TainAn Bill
(cherry picked from commit 4f8043e658)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This fixes#20995. The reference is taken twice and assigned to the same pointer (see above in the same function). Only the latter is needed.
(cherry picked from commit 66a8c37582)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: cfhd_transform2_output_width_oob.avi
Fixes: MimvoaEVpKow
Found-by: Adrian Junge (vurlo)
(cherry picked from commit db05df9d13)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
RTSP redirects retain URL credentials and authentication state when a
Location URI changes to another origin. This can forward reusable
credentials to a server with a different scheme, host, or port.
Clear the stored credentials and authentication state when the redirect
crosses an origin boundary. Preserve them for same-origin redirects.
Fixes: cross-origin credential disclosure
Fixes: rtsp_redirect_auth_leak_poc.py
Fixes: VaKaPOnfN02z
(cherry picked from commit a441a2eb38)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
(cherry picked from commit 372a611913)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
(cherry picked from commit 534f16d866)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
(cherry picked from commit 79e10e5196)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
(cherry picked from commit f1ed338541)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
(cherry picked from commit e38b5d15bd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: use of uninitialized memory
Fixes: rscc_short_deflate_heap_disclosure.avi
Fixes: plB80py3i3Bu
Found-by: Adrian Junge (vurlo)
(cherry picked from commit cd1f545cf2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: signed integer overflow
Fixes: out of array access
Fixes: poc.wtv
Fixes: fJeEU9JwKwsR
Found-by: Adrian Junge (vurlo)
(cherry picked from commit 93f2a525ec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
tls_open() installed a peer-identity target only when the URL host was
non-numeric. For a numeric-IP target the whole block was skipped, so
with verify=1 OpenSSL validated the chain to a trusted CA but bound no
identity, and any publicly-trusted certificate for any name was accepted
(e.g. tls://203.0.113.10?verify=1).
Run the identity block for every non-listening connection. Classify
s->host with the same getaddrinfo(AI_NUMERICHOST) rule tls.c uses. A
numeric host is pinned to the certificate's iPAddress SAN by handing
OpenSSL the parsed binary address via X509_VERIFY_PARAM_set1_ip();
everything else, including a verifyhost=<name> override, binds by name
via SSL_set1_host(). Passing the binary address rather than re-probing
the ASCII form pins legacy numeric spellings such as 2130706433 as IPs
instead of letting them fall back to hostname matching. SNI is still
suppressed for numeric transport hosts (RFC 6066 sec. 3) via
s->numerichost.
The identity target is installed unconditionally for non-listening
connections; whether the certificate is actually verified stays
controlled separately by SSL_CTX_set_verify() under s->verify, so
disabling verification keeps the prior behaviour. Sets AVERROR_EXTERNAL
with an explicit log line on failure.
dtls_open() sets s->is_dtls and then calls tls_open(), so DTLS client
connections run through the same identity block and are covered here.
Found-by: Claude (Anthropic). Human-verified and reported by
Omkhar Arasaratnam <omkhar@linkedin.com>.
Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>
(cherry picked from commit 83c6922826)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
(cherry picked from commit e2bc6d88cd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: use of uninitialized memory
Fixes: screenpresso_short_zlib_heap_disclosure.avi
Fixes: ksUBwBOjJodq
Found-by: Adrian Junge (vurlo)
(cherry picked from commit 7058900614)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fix: vulnerability:019f3b84-903b-75fb-a8de-fad1c2d7e99c
The parse_playlist() path for opening a new child playlist (in == NULL)
directly called c->ctx->io_open(), bypassing the protocol whitelist and
file-extension checks that open_url() enforces. This allowed child URLs
from a master playlist to use protocols other than file/http/data or to
have disallowed extensions.
Route the !in branch through open_url() so that all child playlists are
subject to the same security policy as segment URLs.
Fixes a security bypass in HLS master playlist parsing.
Found-by: depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 23602df9cd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fix: vulnerability:019f3b84-903b-75fb-a8de-fe6f84d6bc32
When parsing IV=0x... followed by a comma, end - ptr was passed directly
to av_strlcpy() as the destination size. Since iv_string is only 33 bytes
(KEYSIZE*2 + 1), a long IV token could overflow into adjacent heap data.
Use FFMIN(end - ptr + 1, sizeof(buf)) to cap the copy size to the actual
buffer size. Apply the same fix to key_uri parsing for consistency.
Fixes a heap buffer overflow in append_list mode when reading an existing
playlist with a crafted IV or URI token length.
Found-by: depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 275e217b10)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
