From f189657ec67cfae78dc7fdf44754aa1633e24be0 Mon Sep 17 00:00:00 2001 From: Zhao Zhili Date: Wed, 11 Mar 2026 21:48:33 +0800 Subject: [PATCH] avformat/rtmpproto: fix listen_timeout conversion for special negative values rtmpproto converts listen_timeout to milliseconds by multiplying it by 1000 before passing it to TCP. However, negative values are special sentinels (e.g., -1 for infinite wait) and should not be multiplied. This worked prior to commit 49c6e6cc44f because there was no range validation. Since that commit, ff_parse_opts_from_query_string validates option values against their declared ranges, causing these multiplied negative values to fail. Fixes ticket #22469. Signed-off-by: Zhao Zhili --- libavformat/rtmpproto.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index d4c9047266..2fa2843c03 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -2736,7 +2736,8 @@ static int rtmp_open(URLContext *s, const char *uri, int flags, AVDictionary **o if (rt->listen) ff_url_join(buf, sizeof(buf), "tcp", NULL, hostname, port, "?listen&listen_timeout=%d&tcp_nodelay=%d", - rt->listen_timeout * 1000, rt->tcp_nodelay); + rt->listen_timeout < 0 ? -1 : rt->listen_timeout * 1000, + rt->tcp_nodelay); else ff_url_join(buf, sizeof(buf), "tcp", NULL, hostname, port, "?tcp_nodelay=%d", rt->tcp_nodelay); }