Files
Franciszek Kalinowski a981a06fe7 avformat/oggparsecelt: bound extra_headers to avoid an effectively infinite loop
celt_header() reads a uint32 `extra_headers` field from the CELT identification
header and stores `1 + extra_headers` into the signed int extra_headers_left.
With extra_headers = 0x7FFFFFFE this becomes INT_MAX and the OGG parser
consumes every subsequent page as a CELT "extra header" without ever reaching
audio data, hanging on any streaming input. A value of 0xFFFFFFFE wraps the
signed addition negative, with the same family of consequences.

Reject any extra_headers count above a small fixed cap (16, well above any
real CELT-over-Ogg stream).

Verified with the audit PoC (a crafted file plus an infinite-page FIFO):
without the patch, ffmpeg consumes pages forever; with the patch it logs
"Too many CELT extra headers (...)" and exits in ~70 ms with
AVERROR_INVALIDDATA.

Reported by Franciszek Kalinowski (isec.pl / striga.ai) and Bartosz Smigielski.

(cherry picked from commit 87439ed619)
2026-05-21 09:36:57 -05:00
..
2023-01-27 19:45:36 +01:00
2023-02-11 21:29:35 +01:00
2022-09-23 20:27:35 +02:00
2022-09-24 17:57:35 +02:00
2022-12-01 11:21:15 +01:00
2022-10-24 02:00:31 +02:00
2022-09-04 15:03:32 -04:00
2023-10-28 19:04:58 +02:00
2023-01-25 18:49:09 +01:00
2023-02-18 09:56:40 +01:00
2025-12-03 20:27:08 +01:00
2022-09-24 17:57:36 +02:00
2022-03-15 09:42:31 -03:00
2022-12-01 11:21:14 +01:00
2025-12-03 20:27:08 +01:00
2023-02-19 01:31:45 +08:00
2025-12-03 20:27:08 +01:00
2025-12-03 20:27:08 +01:00
2022-12-01 11:21:15 +01:00
2022-09-22 17:44:05 +02:00
2024-04-03 02:04:18 +02:00
2022-09-30 19:11:36 +02:00
2023-02-11 21:29:35 +01:00
2025-02-26 16:05:21 -07:00
2025-12-03 20:27:08 +01:00
2023-01-11 18:50:36 +08:00
2025-12-03 20:27:08 +01:00
2022-10-18 13:20:37 +11:00
2023-10-28 19:04:56 +02:00
2022-09-24 18:28:19 +02:00
2023-02-11 11:30:46 +01:00
2022-08-31 16:24:22 +02:00
2023-01-13 11:22:59 -06:00
2023-10-28 20:15:29 +02:00
2023-10-28 20:15:29 +02:00
2022-10-24 02:00:31 +02:00
2022-10-04 23:47:54 +02:00
2023-01-30 21:02:48 +01:00