PR #21568 opened by stevenliu URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21568 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21568.patch
before this commit ffmpeg get Heap Buffer Overflow in DASH Demuxer via Negative Start Number. Check the value from mpd xml, set the value to 0 if get negative value. Fixes: heap buffer overflow Found-by: Zhenpeng (Leo) Lin from depthfirst Signed-off-by: Steven Liu <[email protected]> >From e0f26e0019ea8b4f17de56eddac943b5e2c7093f Mon Sep 17 00:00:00 2001 From: Steven Liu <[email protected]> Date: Sat, 24 Jan 2026 15:22:15 +0800 Subject: [PATCH] avformat/dashdec: check value valid after read value from mpd xml before this commit ffmpeg get Heap Buffer Overflow in DASH Demuxer via Negative Start Number. Check the value from mpd xml, set the value to 0 if get negative value. Fixes: heap buffer overflow Found-by: Zhenpeng (Leo) Lin from depthfirst Signed-off-by: Steven Liu <[email protected]> --- libavformat/dashdec.c | 49 ++++++++++++++++++++++++++++++++++++------- 1 file changed, 42 insertions(+), 7 deletions(-) diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c index 500d8ca518..a41f4b7c5f 100644 --- a/libavformat/dashdec.c +++ b/libavformat/dashdec.c @@ -957,25 +957,45 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url, } val = get_val_from_nodes_tab(fragment_templates_tab, 4, "presentationTimeOffset"); if (val) { - rep->presentation_timeoffset = (int64_t) strtoll(val, NULL, 10); + int64_t presentation_timeoffset = (int64_t) strtoll(val, NULL, 10); + if (presentation_timeoffset < 0) { + av_log(s, AV_LOG_WARNING, "The presentationTimeOffset value invalid, autochanged to 0.\n"); + presentation_timeoffset = 0; + } + rep->presentation_timeoffset = presentation_timeoffset; av_log(s, AV_LOG_TRACE, "rep->presentation_timeoffset = [%"PRId64"]\n", rep->presentation_timeoffset); xmlFree(val); } val = get_val_from_nodes_tab(fragment_templates_tab, 4, "duration"); if (val) { - rep->fragment_duration = (int64_t) strtoll(val, NULL, 10); + int64_t fragment_duration = (int64_t) strtoll(val, NULL, 10); + if (fragment_duration < 0) { + av_log(s, AV_LOG_WARNING, "The duration value invalid, autochanged to 0.\n"); + fragment_duration = 0; + } + rep->fragment_duration = fragment_duration; av_log(s, AV_LOG_TRACE, "rep->fragment_duration = [%"PRId64"]\n", rep->fragment_duration); xmlFree(val); } val = get_val_from_nodes_tab(fragment_templates_tab, 4, "timescale"); if (val) { - rep->fragment_timescale = (int64_t) strtoll(val, NULL, 10); + int64_t fragment_timescale = (int64_t) strtoll(val, NULL, 10); + if (fragment_timescale < 0) { + av_log(s, AV_LOG_WARNING, "The timescale value invalid, autochanged to 0.\n"); + fragment_timescale = 0; + } + rep->fragment_timescale = fragment_timescale; av_log(s, AV_LOG_TRACE, "rep->fragment_timescale = [%"PRId64"]\n", rep->fragment_timescale); xmlFree(val); } val = get_val_from_nodes_tab(fragment_templates_tab, 4, "startNumber"); if (val) { - rep->start_number = rep->first_seq_no = (int64_t) strtoll(val, NULL, 10); + int64_t start_number = (int64_t) strtoll(val, NULL, 10); + if (start_number < 0) { + av_log(s, AV_LOG_WARNING, "The startNumber value invalid, autochanged to 0.\n"); + start_number = 0; + } + rep->start_number = rep->first_seq_no = start_number; av_log(s, AV_LOG_TRACE, "rep->first_seq_no = [%"PRId64"]\n", rep->first_seq_no); xmlFree(val); } @@ -1037,19 +1057,34 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url, val = get_val_from_nodes_tab(segmentlists_tab, 3, "duration"); if (val) { - rep->fragment_duration = (int64_t) strtoll(val, NULL, 10); + int64_t fragment_duration = (int64_t) strtoll(val, NULL, 10); + if (fragment_duration < 0) { + av_log(s, AV_LOG_WARNING, "The duration value invalid, autochanged to 0.\n"); + fragment_duration = 0; + } + rep->fragment_duration = fragment_duration; av_log(s, AV_LOG_TRACE, "rep->fragment_duration = [%"PRId64"]\n", rep->fragment_duration); xmlFree(val); } val = get_val_from_nodes_tab(segmentlists_tab, 3, "timescale"); if (val) { - rep->fragment_timescale = (int64_t) strtoll(val, NULL, 10); + int64_t fragment_timescale = (int64_t) strtoll(val, NULL, 10); + if (fragment_timescale < 0) { + av_log(s, AV_LOG_WARNING, "The timescale value invalid, autochanged to 0.\n"); + fragment_timescale = 0; + } + rep->fragment_timescale = fragment_timescale; av_log(s, AV_LOG_TRACE, "rep->fragment_timescale = [%"PRId64"]\n", rep->fragment_timescale); xmlFree(val); } val = get_val_from_nodes_tab(segmentlists_tab, 3, "startNumber"); if (val) { - rep->start_number = rep->first_seq_no = (int64_t) strtoll(val, NULL, 10); + int64_t start_number = (int64_t) strtoll(val, NULL, 10); + if (start_number < 0) { + av_log(s, AV_LOG_WARNING, "The startNumber value invalid, autochanged to 0.\n"); + start_number = 0; + } + rep->start_number = rep->first_seq_no = start_number; av_log(s, AV_LOG_TRACE, "rep->first_seq_no = [%"PRId64"]\n", rep->first_seq_no); xmlFree(val); } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
