July 2025 - FFmpeg-trac - lists.ffmpeg.org

#11651(undetermined:new): NULL Pointer Dereference in FFmpeg ffprobe
by FFmpeg 05 Jul '25

05 Jul '25

#11651: NULL Pointer Dereference in FFmpeg ffprobe -------------------------------------+------------------------------------- Reporter: momo-trip | Type: defect Status: new | Priority: normal Component: | Version: 7.1 undetermined | Keywords: NULL | Blocked By: pointer dereference | Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- # NULL Pointer Dereference in FFmpeg ffprobe Hi, we have found a NULL pointer dereference in ffprobe and would like to report this issue. Could you confirm if this qualifies as a security bug? I am happy to provide any additional information needed. ## Summary In ffprobe's special syntax `-/opt`, when no subsequent argument exists, a NULL pointer is passed, causing `open(NULL, ...)` to be called and resulting in abnormal termination. This is reproducible with input alone, and in service environments that automatically execute ffprobe, this constitutes a DoS attack. ## Details - **Vulnerability Type:** NULL Pointer Dereference arising from Improper Input Validation, CWE-20 - **Product:** FFmpeg (ffprobe) - **Version:** 7.1.1 (commit f11962f, 2025-05-15) - **Configuration:** Default settings, no additional options - **Attack Vector:** Local CLI (arbitrary user input) - **Impact:** Process abnormal termination (service interruption) - **Privileges Required / User Interaction:** None required / Command execution only ## Reproduction ### Environment - **Operating System:** Ubuntu 22.04 LTS - **Architecture:** x86-64 - **Compiler:** clang 15.0.7 + AddressSanitizer ### Reproduction Steps ```bash # Clone and build (ASan enabled) git clone https://github.com/FFmpeg/FFmpeg.git cd FFmpeg git checkout f11962f ./configure --enable-gpl \ CC=clang CFLAGS="-fsanitize=address -g -O1" \ LDFLAGS="-fsanitize=address" make -j$(nproc) # Crash examples ./ffprobe -/version ./ffprobe -/L ./ffprobe -/buildconf ``` ### Crash Log ```bash Output (AddressSanitizer excerpt) ==7854==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 #0 0x7f2b6c in open (/usr/lib/x86_64-linux-gnu/libc.so.6+0xfa6c) #1 0x5605fd in file_read fftools/cmdutils.c:272 #2 0x5632ab in parse_option fftools/cmdutils.c:266 #3 0x564de0 in parse_options fftools/cmdutils.c:448 ... AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f2b6c ...) ``` ## Root Cause Analysis ### Affected Code https://github.com/FFmpeg/FFmpeg/blob/master/fftools/cmdutils.c#L431 https://github.com/FFmpeg/FFmpeg/blob/master/fftools/cmdutils.c#L255 ```c // parse_options() (approximately lines 431–441) opt = argv[optindex++]; /* optindex is incremented */ ... if ((ret = parse_option(optctx, opt, argv[optindex], options)) < 0) return ret; /* when optindex == argc, argv[...] is NULL */ // write_option() (approximately lines 255–274) if (*opt == '/') { opt++; /* No validation for argument requirement or arg==NULL */ arg_allocated = file_read(arg); /* arg is NULL → open(NULL, ...) */ } ``` ## Impact Assessment - No elements of remote code execution or information disclosure are present. - However, in automated analysis services that launch ffprobe, it is possible to stop the process with a single malicious argument, affecting availability. ## Proposed Fix - Utilize `opt_has_arg(const OptionDef *po)` to reference `argv[optindex]` only for options that require arguments. - When `/` syntax is detected: - Check if the target option requires an argument; reject if not required. - If `arg == NULL`, return with "file not specified" error. ```c /* parse_options() */ const OptionDef *po = find_option(options, name); if (po && opt_has_arg(po) && optindex >= argc) { av_log(NULL, AV_LOG_ERROR, "Missing argument for option '%s'\n", opt); return AVERROR(EINVAL); } /* -/ processing in write_option() */ if (*opt == '/') { opt++; if (!opt_has_arg(po)) { av_log(NULL, AV_LOG_ERROR, "Option '%s' does not take an argument; '-/%s' is invalid\n", po->name, po->name); return AVERROR(EINVAL); } if (!arg) { av_log(NULL, AV_LOG_ERROR, "No file specified after '-/%s'\n", po->name); return AVERROR(EINVAL); } } ``` -- Ticket URL: <https://trac.ffmpeg.org/ticket/11651> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 1

#9281(ffmpeg:new): wrong $Number$ value while reading mpd
by FFmpeg 04 Jul '25

04 Jul '25

#9281: wrong $Number$ value while reading mpd -------------------------------------+------------------------------------- Reporter: Kostik | Type: defect Status: new | Priority: normal Component: ffmpeg | Version: Keywords: mpd | unspecified manifest | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Hello, using the latest static build ffmpeg version N-57631-gebedd26eef-static I want to read mpd and convert to mpegts - this part works ok, except one manifest looks like ffmpeg make wrong calculation for $Number$ In my case I have availabilityStartTime="2021-05-27T11:59:16Z" media="$RepresentationID$-$Number$.m4s" duration="180180" startNumber="487925" presentationTimeOffset="89360526151" I expect $Number$ to be converted to 488430 (and other players do so), but ffmpeg try retrieve 397033568 here is full manifest <?xml version="1.0" encoding="UTF-8"?> <MPD xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="urn:mpeg:dash:schema:mpd:2011" xmlns:cenc="urn:mpeg:cenc:2013" xmlns:mspr="urn:microsoft:playready" xsi:schemaLocation="urn:mpeg:dash:schema:mpd:2011 DASH-MPD.xsd" type="dynamic" minimumUpdatePeriod="PT6S" minBufferTime="PT1.000S" maxSegmentDuration="PT3.003S" availabilityStartTime="2021-05-27T11:59:16Z" timeShiftBufferDepth="PT36.036S" publishTime="2021-06-07T19:25:48Z" profiles="urn:mpeg:dash:profile:isoff-live:2011"> <Period id="487925" start="PT976813.47S"> <AdaptationSet mimeType="video/mp4" segmentAlignment="true" startWithSAP="1" maxWidth="1280" maxHeight="720" maxFrameRate="60000/1001" par="16:9"> <InbandEventStream schemeIdUri="urn:mpeg:dash:event:2012" value="1"/> <Accessibility schemeIdUri="urn:scte:dash:cc:cea-608:2015" value="CC1:und;CC2:und"/> <SegmentTemplate timescale="90000" media="$RepresentationID$-$Number$.m4s" startNumber="487925"/> <Representation id="video1" width="1280" height="720" frameRate="60000/1001" sar="1:1" scanType="progressive" bandwidth="6562944" codecs="avc1.640029"/> </AdaptationSet> <AdaptationSet mimeType="audio/mp4" lang="en" segmentAlignment="true" startWithSAP="1"> <Role schemeIdUri="urn:mpeg:dash:role:2011" value="main"/> <SegmentTemplate timescale="90000" media="$RepresentationID$-$Number$.m4s" startNumber="487925"/> <Representation id="audio1" audioSamplingRate="44100" bandwidth="96000" codecs="mp4a.40.2"> <AudioChannelConfiguration schemeIdUri="urn:mpeg:dash:23003:3:audio_channel_configuration:2011" value="2"/> </Representation> </AdaptationSet> <AdaptationSet mimeType="audio/mp4" lang="es" segmentAlignment="true" startWithSAP="1"> <Role schemeIdUri="urn:mpeg:dash:role:2011" value="dub"/> <SegmentTemplate timescale="90000" media="$RepresentationID$-$Number$.m4s" startNumber="487925"/> <Representation id="audio2" audioSamplingRate="44100" bandwidth="96000" codecs="mp4a.40.2"> <AudioChannelConfiguration schemeIdUri="urn:mpeg:dash:23003:3:audio_channel_configuration:2011" value="2"/> </Representation> </AdaptationSet> </Period> <UTCTiming schemeIdUri="urn:mpeg:dash:utc:direct:2014" value="2021-06-07T19:25:48Z"/> </MPD> -- Ticket URL: <https://trac.ffmpeg.org/ticket/9281> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 2

#11654(undetermined:new): addtional sps/pps gets added when remuxing mxf files
by FFmpeg 03 Jul '25

03 Jul '25

#11654: addtional sps/pps gets added when remuxing mxf files -------------------------------------+------------------------------------- Reporter: Andy | Type: defect Status: new | Priority: normal Component: | Version: undetermined | unspecified Keywords: mp4 avc | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Summary of the bug: How to reproduce: {{{ % ffmpeg -i <sourcefile>.mxf -c:v copy -c:a copy -movflags +faststart <destfile>.mp4 }}} {{{ ffmpeg version 2025-06-02-git-688f3944ce-full_build-www.gyan.dev Copyright (c) 2000-2025 the FFmpeg developers }}} TestFiles: 1920x1080i25 AVCI1080i25.mxf (original File) AVCI1080i25.mp4 (ffmpeg remux) AVCI1080i25.h264 (bitstream dump) 1920x1080p25 AVCI1080p25.mxf (original File) AVCI1080p25.mp4 (ffmpeg remux) AVCI1080p25.h264 (bitstream dump) 960x540p25 LowRes.mxf (original File) LowRes.mp4 (ffmpeg remux) LowRes.h264 (bitstream dump) Issue: In the orignal mxf files, there are sps/pps in every frame. When i remux these avc-files, ffmpeg always adds an additional sps/pps to the first frame of the file. In the 1920x1080 files, it containes the same profile and level indication but in the "lowres" file, the behaviour is even different. It adds an sps/pps with different profile and level which causes most players to not play the file. I just wanted to clear, if this is a bug or intended and maybe to prevent this by using a cmdline switch while remuxing. Thank you -- Ticket URL: <https://trac.ffmpeg.org/ticket/11654> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 1