PR #22721 opened by bird URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22721 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22721.patch
Fixes #22717 See issue for crash matrix, reproducer, and root cause analysis. >From 6d035e31e718bde78ac84b9ac4ebae5fb37b9c46 Mon Sep 17 00:00:00 2001 From: bird <[email protected]> Date: Sun, 5 Apr 2026 05:51:40 +0000 Subject: [PATCH] avformat/rtpenc: raise minimum packet_size to prevent integer underflow Individual RTP codec packetizers subtract per-codec header sizes from max_payload_size without checking for underflow. When packet_size is between 13 and ~32, max_payload_size is positive but smaller than the codec header, causing the subtraction to wrap negative. This value propagates through FFMIN() to memcpy(), where the implicit cast to size_t produces a near-SIZE_MAX length, causing a heap buffer overflow and immediate SIGSEGV. The existing check (packet_size <= 12) only ensures the 12-byte RTP base header fits but does not account for per-codec payload headers (2-20+ bytes depending on codec). Affected codecs confirmed via SIGSEGV: VP8 (header 4), H.264 (2-3), HEVC (2-3), H.261 (4), AAC (4+), Vorbis/Xiph (6), Theora/Xiph (6) Reproducer: ffmpeg -f lavfi -i testsrc=d=0.1:s=16x16:r=1 -c:v libvpx \ -f rtp -packetsize 13 rtp://127.0.0.1:9999 Signed-off-by: bird <[email protected]> --- libavformat/rtpenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtpenc.c b/libavformat/rtpenc.c index 1d4b00a0f4..fdff4820d2 100644 --- a/libavformat/rtpenc.c +++ b/libavformat/rtpenc.c @@ -152,7 +152,7 @@ static int rtp_write_header(AVFormatContext *s1) s1->pb->max_packet_size); } else s1->packet_size = s1->pb->max_packet_size; - if (s1->packet_size <= 12) { + if (s1->packet_size <= 44) { av_log(s1, AV_LOG_ERROR, "Max packet size %u too low\n", s1->packet_size); return AVERROR(EIO); } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
