[PR] avformat/mpegts: max_packet_size fixes (PR #24099)

PR #24099 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24099
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24099.patch


>From 06974f00f2ac6b037142ea69c160d98e61214959 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Wed, 12 Aug 2026 01:34:26 +0200
Subject: [PATCH 1/2] avformat/mpegts: keep the PES payload within
 max_packet_size

Fixes: out of array access
Fixes: eYvYXUJZbPJ
Regression since: bca30570d28bbaa07badadabf55ec3589201a82f
Found-by: Eunsoo Kim, Microsoft FORGE Labs
---
 libavformat/mpegts.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
index 076020509d..326f07abb1 100644
--- a/libavformat/mpegts.c
+++ b/libavformat/mpegts.c
@@ -1461,7 +1461,8 @@ skip:
             do {
                 int max_packet_size = ts->max_packet_size;
                 if (pes->PES_packet_length && pes->PES_packet_length + PES_START_SIZE > pes->pes_header_size)
-                    max_packet_size = pes->PES_packet_length + PES_START_SIZE - pes->pes_header_size;
+                    max_packet_size = FFMIN(pes->PES_packet_length + PES_START_SIZE - pes->pes_header_size,
+                                            ts->max_packet_size);
 
                 if (pes->data_index > 0 &&
                     pes->data_index + buf_size > max_packet_size) {
-- 
2.52.0


>From 67029736e4d338e29a692bed7f55a213b2ef1f9a Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Wed, 12 Aug 2026 01:34:52 +0200
Subject: [PATCH 2/2] avformat/mpegts: reject a max_packet_size below one TS
 payload

Fixes:  ffmpeg -max_packet_size 100 -i fate-suite/mpegts/h264small.ts -f null -

Fixes: out of array access
Fixes: eYvYXUJZbPJ
Regression since: bca30570d28bbaa07badadabf55ec3589201a82f
Found-by: Eunsoo Kim, Microsoft FORGE Labs
---
 doc/demuxers.texi    | 2 +-
 libavformat/mpegts.c | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/doc/demuxers.texi b/doc/demuxers.texi
index a1dd879b59..8603069949 100644
--- a/doc/demuxers.texi
+++ b/doc/demuxers.texi
@@ -1008,7 +1008,7 @@ streams move to different PIDs. Default value is 0.
 
 @item max_packet_size
 Set maximum size, in bytes, of packet emitted by the demuxer. Payloads above this size
-are split across multiple packets. Range is 1 to INT_MAX/2. Default is 204800 bytes.
+are split across multiple packets. Range is 184 to INT_MAX/2. Default is 204800 bytes.
 @end table
 
 @section mpjpeg
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
index 326f07abb1..ca9d33671b 100644
--- a/libavformat/mpegts.c
+++ b/libavformat/mpegts.c
@@ -52,6 +52,9 @@
  * synchronization is lost */
 #define MAX_RESYNC_SIZE 65536
 
+/* payload of a TS packet which carries no adaptation field */
+#define TS_PAYLOAD_SIZE (TS_PACKET_SIZE - 4)
+
 #define MAX_MP4_DESCR_COUNT 16
 
 #define MOD_UNLIKELY(modulus, dividend, divisor, prev_dividend)                \
@@ -223,7 +226,7 @@ static const AVOption options[] = {
     {"skip_clear", "skip clearing programs", offsetof(MpegTSContext, skip_clear), AV_OPT_TYPE_BOOL,
      {.i64 = 0}, 0, 1, 0 },
     {"max_packet_size", "maximum size of emitted packet", offsetof(MpegTSContext, max_packet_size), AV_OPT_TYPE_INT,
-     {.i64 = 204800}, 1, INT_MAX/2, AV_OPT_FLAG_DECODING_PARAM },
+     {.i64 = 204800}, TS_PAYLOAD_SIZE, INT_MAX/2, AV_OPT_FLAG_DECODING_PARAM },
     { NULL },
 };
 
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]