Stowage/ffmpeg
2
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-15 12:00:33 +00:00
Code Issues Projects Releases Packages Wiki Activity

avformat/mpegts: Check IOD_DESCRIPTOR len

Browse source 
Fixes: out of array read
Fixes: VULN-7/poc.ts

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5975149603)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2026-01-23 15:48:15 +01:00
parent 91146cb57a
commit 04848bb2ff
No known key found for this signature in database
GPG key ID: B18E8928B3948D64
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
libavformat/mpegts.c
View file

@ -2412,7 +2412,7 @@ static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len
// something else is broken, exit the program_descriptors_loop
break;
program_info_length -= len;
if (tag == IOD_DESCRIPTOR) {
if (tag == IOD_DESCRIPTOR && len >= 2) {
get8(&p, p_end); // scope
get8(&p, p_end); // label
len -= 2;