mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2026-11-06 05:17:42 +00:00
Alexkane
e2740a3e0d
set_string_number() parses the operand of a "+x" or "-x" flags update as a double and casts it to int64_t to OR it into, or mask it out of, the current flags. Only the combined value then reaches the range check in write_number(), so the operand itself was never validated: - A value outside the int64_t range, or inf, makes the conversion undefined behaviour (C17 6.3.1.4). UBSan reports it for av_opt_set(ctx, "flags", "+77777777777777777777", 0), and what the cast produces depends on the target: measured on AArch64, where it saturates, "+1e20" happened to be rejected downstream while "-1e20" was accepted. - A fractional operand is silently truncated, so "+1.5" and "-1.5" are accepted although "1.5" is refused as not being a valid set of flags. Run the existing flags range check on the operand before the cast, so an invalid operand returns AVERROR(ERANGE) exactly like an invalid absolute value, as av_opt_set() documents, and add the four cases to fate-opt. Reported by FuzzAnything-ORG with a UBSan trace. Fixes #22389
FFmpeg README
FFmpeg is a collection of libraries and tools to process multimedia content such as audio, video, subtitles and related metadata.
Libraries
libavcodecprovides implementation of a wider range of codecs.libavformatimplements streaming protocols, container formats and basic I/O access.libavutilincludes hashers, decompressors and miscellaneous utility functions.libavfilterprovides means to alter decoded audio and video through a directed graph of connected filters.libavdeviceprovides an abstraction to access capture and playback devices.libswresampleimplements audio mixing and resampling routines.libswscaleimplements color conversion and scaling routines.
Tools
- ffmpeg is a command line toolbox to manipulate, convert and stream multimedia content.
- ffplay is a minimalistic multimedia player.
- ffprobe is a simple analysis tool to inspect multimedia content.
- Additional small tools such as
aviocat,ismindexandqt-faststart.
Documentation
The offline documentation is available in the doc/ directory.
The online documentation is available in the main website and in the wiki.
Examples
Coding examples are available in the doc/examples directory.
License
FFmpeg codebase is mainly LGPL-licensed with optional components licensed under GPL. Please refer to the LICENSE file for detailed information.
Contributing
Patches should be submitted to Forgejo or the ffmpeg-devel mailing list using git format-patch or git send-email. Github pull requests should be avoided because they are not part of our review process and will be ignored.
See https://ffmpeg.org/developer.html for more information.