PR #22303 opened by Nariman-Sayed URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22303 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22303.patch
When neither audio_par nor video_par is set, bundle_index remains 0, causing bundle[-1] = '\0' which is an out-of-bounds write. Fix by checking bundle_index before accessing the array. >From 3b5c25568cc34f6b4c6f03f4bb5a0e3c436b0525 Mon Sep 17 00:00:00 2001 From: Nariman-Sayed <[email protected]> Date: Fri, 27 Feb 2026 02:47:54 +0200 Subject: [PATCH] avformat/whip: fix out-of-bounds write in bundle string when no streams --- libavformat/whip.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/whip.c b/libavformat/whip.c index 8306296b20..affdb0d6e3 100644 --- a/libavformat/whip.c +++ b/libavformat/whip.c @@ -641,7 +641,10 @@ static int generate_sdp_offer(AVFormatContext *s) bundle[bundle_index++] = '1'; bundle[bundle_index++] = ' '; } - bundle[bundle_index - 1] = '\0'; + if (bundle_index > 0) + bundle[bundle_index - 1] = '\0'; + else + bundle[0] = '\0'; av_bprintf(&bp, "" "v=0\r\n" -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
