Files
FFmpeg/libavformat
Nicholas Carlini 55bf0e6cd5 avformat/mpegts: remove JPEG-XS early return on invalid header_size
new_pes_packet() moves a buffer with pkt->buf = pes->buffer before
JPEG-XS validation. If header_size > pkt->size, an early return leaves
pes->buffer as a stale alias of pkt->buf with refcount 1. Later,
mpegts_read_packet() calls av_packet_unref(), freeing the buffer
through pkt->buf. The flush loop then re-enters new_pes_packet() and
dereferences the dangling pes->buffer; a second path hits it via
av_buffer_unref() in handle_packets() after a seek.

Drop the early return. The packet is delivered with AV_PKT_FLAG_CORRUPT
set, matching the PES-size-mismatch case above, and the function falls
through to the normal cleanup path. The else guards the header trim so
pkt->data/pkt->size stay valid for the memset.

Fixes: use after free
Fixes regression since 16f89d342e.

Found-by: Nicholas Carlini <nicholas@carlini.com>
2026-03-14 21:01:41 +00:00
..
2025-08-03 13:48:47 +02:00
2026-03-10 13:52:18 +01:00
2025-09-08 20:59:31 +00:00
2025-04-13 22:49:21 +02:00
2024-09-24 15:37:15 +02:00
2025-04-13 22:49:21 +02:00
2026-03-10 13:52:18 +01:00
2024-03-31 00:08:43 +01:00
2025-08-03 13:48:47 +02:00
2026-03-10 13:52:18 +01:00
2026-03-10 13:52:18 +01:00
2026-03-10 13:52:18 +01:00
2024-03-26 06:36:43 +01:00
2026-03-10 13:52:18 +01:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2026-02-19 17:18:11 +01:00
2026-03-10 13:52:18 +01:00
2026-03-10 13:52:18 +01:00
2024-06-19 10:12:50 -03:00
2025-08-03 13:48:47 +02:00
2024-03-26 06:36:43 +01:00
2025-08-03 13:48:47 +02:00
2025-06-23 17:19:18 +10:00
2026-02-25 02:55:43 +00:00
2025-08-03 13:48:47 +02:00
2024-06-04 11:46:27 +02:00
2026-03-10 13:52:18 +01:00
2024-07-21 16:41:23 +02:00
2026-03-10 13:52:18 +01:00
2026-02-18 08:20:10 +00:00
2026-03-10 13:52:18 +01:00
2023-05-31 09:03:58 -07:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2024-04-17 18:31:06 +05:30
2024-05-01 02:57:12 +02:00
2026-03-10 13:52:18 +01:00
2025-08-03 13:48:47 +02:00
2024-04-06 12:59:56 +02:00
2025-08-04 03:59:42 +00:00
2025-08-03 13:48:47 +02:00
2026-02-23 20:20:20 +01:00
2024-03-31 00:08:43 +01:00
2025-11-09 13:44:18 +01:00
2026-03-10 13:52:18 +01:00
2026-03-10 13:52:18 +01:00
2025-10-25 19:22:48 +00:00
2025-03-28 15:23:28 +01:00
2026-03-10 13:52:18 +01:00
2026-02-09 14:01:14 +00:00
2024-03-31 00:08:43 +01:00
2026-02-23 20:20:20 +01:00
2025-08-03 13:48:47 +02:00
2024-11-03 10:53:15 +11:00
2026-03-10 13:52:18 +01:00
2025-06-23 17:19:18 +10:00
2024-03-15 12:51:15 +01:00
2024-03-15 12:51:15 +01:00
2026-02-08 02:25:14 +01:00
2026-03-10 13:52:18 +01:00
2025-08-03 13:48:47 +02:00
2024-03-31 00:08:43 +01:00
2026-03-10 13:52:18 +01:00
2026-03-10 13:52:18 +01:00
2026-03-10 13:52:18 +01:00
2025-09-19 09:59:26 +02:00
2025-08-03 13:48:47 +02:00
2024-07-21 17:02:11 +02:00
2026-03-10 13:52:18 +01:00
2024-03-26 06:36:43 +01:00
2025-08-03 13:48:47 +02:00
2026-02-25 02:55:43 +00:00
2026-03-10 13:52:18 +01:00
2025-08-03 13:48:47 +02:00
2024-03-26 06:36:43 +01:00
2024-03-31 00:08:43 +01:00