This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.1 in repository ffmpeg.
commit bda47c505fb6f0ad43f68515bc457dcf70e30744 Author: Michael Niedermayer <[email protected]> AuthorDate: Fri May 8 21:19:14 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 14 04:40:50 2026 +0200 avformat/mpegts: Dont assume fc->priv_data is a MpegTSContext Fixes: out of array access Fixes: 508365271/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6219535958212608 Regression since: b9cb948ec1 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 188461be105cb2cb28eb8e4ef0a85a0a6d03a1f9) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mpegts.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 4b326d309b..337fdd155f 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -280,6 +280,8 @@ EXTERN const FFInputFormat ff_mpegts_demuxer; static struct Program * get_program(MpegTSContext *ts, unsigned int programid) { int i; + if (!ts) + return NULL; for (i = 0; i < ts->nb_prg; i++) { if (ts->prg[i].id == programid) { return &ts->prg[i]; @@ -1836,9 +1838,9 @@ static const uint8_t opus_channel_map[8][8] = { }; static int parse_mpeg2_extension_descriptor(AVFormatContext *fc, AVStream *st, int prg_id, - const uint8_t **pp, const uint8_t *desc_end) + const uint8_t **pp, const uint8_t *desc_end, + MpegTSContext *ts) { - MpegTSContext *ts = fc->priv_data; int ext_tag = get8(pp, desc_end); switch (ext_tag) { @@ -2438,7 +2440,7 @@ int ff_parse_mpeg2_descriptor(AVFormatContext *fc, AVStream *st, int stream_type break; case EXTENSION_DESCRIPTOR: /* descriptor extension */ { - int ret = parse_mpeg2_extension_descriptor(fc, st, prg_id, pp, desc_end); + int ret = parse_mpeg2_extension_descriptor(fc, st, prg_id, pp, desc_end, ts); if (ret < 0) return ret; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
