This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.0 in repository ffmpeg.
commit bdc40e57dd3af68aba69776e88e67bc543cc3105 Author: depthfirst-dev[bot] <1012587+depthfirst-dev[bot]@users.noreply.github.com> AuthorDate: Thu Apr 23 02:47:11 2026 +0000 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun May 3 19:56:59 2026 +0200 avformat/rtspdec: reject non-positive ANNOUNCE Content-Length rtsp_read_announce() treated any non-zero Content-Length as valid, including negative values parsed via strtol(). This could send invalid sizes into allocation, body reads and trailing NUL writes. Accept only strictly positive SDP body lengths and reject invalid Content-Length values with AVERROR_INVALIDDATA. Found-by: Seung Min Shin (was reported to us on 10th April) CC: 신승민 <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit eec78bdac1ae585d7e07df61844684a0e3ec4680) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/rtspdec.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavformat/rtspdec.c b/libavformat/rtspdec.c index 88a57b01ef..948a683293 100644 --- a/libavformat/rtspdec.c +++ b/libavformat/rtspdec.c @@ -190,7 +190,7 @@ static int rtsp_read_announce(AVFormatContext *s) rtsp_send_reply(s, RTSP_STATUS_SERVICE, NULL, request.seq); return AVERROR_OPTION_NOT_FOUND; } - if (request.content_length) { + if (request.content_length > 0) { sdp = av_malloc(request.content_length + 1); if (!sdp) return AVERROR(ENOMEM); @@ -214,10 +214,10 @@ static int rtsp_read_announce(AVFormatContext *s) return 0; } av_log(s, AV_LOG_ERROR, - "Content-Length header value exceeds sdp allocated buffer (4KB)\n"); + "Invalid ANNOUNCE Content-Length %d\n", request.content_length); rtsp_send_reply(s, RTSP_STATUS_INTERNAL, - "Content-Length exceeds buffer size", request.seq); - return AVERROR(EIO); + "Invalid Content-Length", request.seq); + return AVERROR_INVALIDDATA; } static int rtsp_read_options(AVFormatContext *s) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
