Files
FFmpeg/libavformat
Ruikai Peng 16f89d342e avformat/mpegts: bounds-check JPEG-XS header_size before padding
Regression since: 536475ea05.

The JPEG-XS PES path trusted header_size from the payload and advanced
pkt->data/pkt->size without validation, so the trailing memset could
write out of bounds when header_size > pkt->size. Reject such packets,
marking them corrupt and returning an error to avoid the OOB write.

Repro (ASan):
ASAN_OPTIONS=halt_on_error=1:detect_leaks=0   ./ffmpeg -v debug -nostdin -i poc-jpegxs.ts -copy_unknown -map 0   -c copy -f null /dev/null

Crash in new_pes_packet memset on crafted TS with stream_id 0xbd,
stream_type 0x32, header_size 0xFFFFFF00, payload starting with jxes.

Found-by: Pwno
2025-12-14 17:42:59 +00:00
..
2025-08-03 13:48:47 +02:00
2024-08-28 16:27:54 +02:00
2025-09-08 20:59:31 +00:00
2025-04-13 22:49:21 +02:00
2024-09-24 15:37:15 +02:00
2025-04-13 22:49:21 +02:00
2024-03-31 00:08:43 +01:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2024-06-19 10:12:50 -03:00
2025-08-25 18:15:17 +08:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-06-23 17:19:18 +10:00
2025-08-03 13:48:47 +02:00
2024-06-04 11:46:27 +02:00
2024-07-21 16:41:23 +02:00
2025-09-21 17:42:19 +08:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2024-04-17 18:31:06 +05:30
2024-05-01 02:57:12 +02:00
2025-08-03 13:48:47 +02:00
2024-04-06 12:59:56 +02:00
2025-08-04 03:59:42 +00:00
2025-08-03 13:48:47 +02:00
2025-09-20 00:31:10 +02:00
2024-03-31 00:08:43 +01:00
2025-11-09 13:44:18 +01:00
2024-03-31 00:08:43 +01:00
2025-10-25 19:22:48 +00:00
2025-03-28 15:23:28 +01:00
2024-03-31 00:08:43 +01:00
2025-08-03 13:48:47 +02:00
2024-11-03 10:53:15 +11:00
2025-06-23 17:19:18 +10:00
2025-07-07 01:45:10 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2024-03-31 00:08:43 +01:00
2025-09-19 09:59:26 +02:00
2025-08-03 13:48:47 +02:00
2024-07-21 17:02:11 +02:00
2025-10-30 17:22:12 -07:00
2025-12-07 19:36:03 +00:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2024-03-31 00:08:43 +01:00