PR #23784 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23784 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23784.patch
This variant is easy backportable but is concatdec specific Fixes: self_ref.ffconcat Reported-by: Yuhao Jiang <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> >From 074ffaa7e767732b9cf7077429d5bd284f34bd52 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 7 Jul 2025 02:53:18 +0200 Subject: [PATCH] avformat/concatdec: Check recursion depth This variant is easy backportable but is concatdec specific Fixes: self_ref.ffconcat Reported-by: Yuhao Jiang <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/concatdec.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/libavformat/concatdec.c b/libavformat/concatdec.c index c57d1b649a..d540feca21 100644 --- a/libavformat/concatdec.c +++ b/libavformat/concatdec.c @@ -73,6 +73,7 @@ typedef struct { ConcatMatchMode stream_match_mode; unsigned auto_convert; int segment_time_metadata; + int recursion_depth; } ConcatContext; static int concat_probe(const AVProbeData *probe) @@ -357,6 +358,8 @@ static int open_file(AVFormatContext *avf, unsigned fileno) if (ret < 0) return ret; + av_dict_set_int(&options, "recursion_depth", cat->recursion_depth - 1, 0); + if ((ret = avformat_open_input(&cat->avf, file->url, NULL, &options)) < 0 || (ret = avformat_find_stream_info(cat->avf, NULL)) < 0) { av_log(avf, AV_LOG_ERROR, "Impossible to open '%s'\n", file->url); @@ -364,6 +367,7 @@ static int open_file(AVFormatContext *avf, unsigned fileno) avformat_close_input(&cat->avf); return ret; } + av_dict_set(&options, "recursion_depth", NULL, 0); if (options) { av_log(avf, AV_LOG_WARNING, "Unused options for '%s'.\n", file->url); /* TODO log unused options once we have a proper string API */ @@ -665,6 +669,11 @@ static int concat_read_header(AVFormatContext *avf) unsigned i; int ret; + if (cat->recursion_depth <= 0) { + av_log(avf, AV_LOG_ERROR, "Too deep recursion\n"); + return AVERROR_INVALIDDATA; + } + ret = concat_parse_script(avf); if (ret < 0) return ret; @@ -940,6 +949,8 @@ static const AVOption options[] = { OFFSET(auto_convert), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, DEC }, { "segment_time_metadata", "output file segment start time and duration as packet metadata", OFFSET(segment_time_metadata), AV_OPT_TYPE_BOOL, {.i64 = 0}, 0, 1, DEC }, + { "recursion_depth", "max recursion depth", + OFFSET(recursion_depth), AV_OPT_TYPE_INT, {.i64 = 10}, 0, INT_MAX, DEC }, { NULL } }; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
