Franciszek Kalinowski
a981a06fe7
avformat/oggparsecelt: bound extra_headers to avoid an effectively infinite loop
...
celt_header() reads a uint32 `extra_headers` field from the CELT identification
header and stores `1 + extra_headers` into the signed int extra_headers_left.
With extra_headers = 0x7FFFFFFE this becomes INT_MAX and the OGG parser
consumes every subsequent page as a CELT "extra header" without ever reaching
audio data, hanging on any streaming input. A value of 0xFFFFFFFE wraps the
signed addition negative, with the same family of consequences.
Reject any extra_headers count above a small fixed cap (16, well above any
real CELT-over-Ogg stream).
Verified with the audit PoC (a crafted file plus an infinite-page FIFO):
without the patch, ffmpeg consumes pages forever; with the patch it logs
"Too many CELT extra headers (...)" and exits in ~70 ms with
AVERROR_INVALIDDATA.
Reported by Franciszek Kalinowski (isec.pl / striga.ai) and Bartosz Smigielski.
(cherry picked from commit 87439ed619 )
2026-05-21 09:36:57 -05:00
..
2022-11-03 21:16:10 +10:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-01-27 19:45:36 +01:00
2024-04-03 02:04:25 +02:00
2023-02-09 15:24:15 +01:00
2023-02-11 21:29:35 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2022-09-23 20:27:35 +02:00
2022-09-24 17:57:35 +02:00
2022-12-01 11:21:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2022-09-19 17:05:33 +02:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-10-28 20:15:29 +02:00
2022-10-20 21:42:20 +02:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2022-10-24 02:00:31 +02:00
2023-02-09 15:24:15 +01:00
2022-09-26 03:02:50 +02:00
2023-02-16 01:18:45 +01:00
2023-02-16 01:18:45 +01:00
2022-09-24 14:03:59 +02:00
2023-02-09 15:24:15 +01:00
2022-10-03 23:21:57 +02:00
2023-02-09 15:35:14 +01:00
2023-02-09 15:35:14 +01:00
2022-09-04 15:03:32 -04:00
2023-10-28 19:04:58 +02:00
2023-10-28 20:15:29 +02:00
2023-02-09 15:24:15 +01:00
2023-01-25 18:49:09 +01:00
2022-09-03 15:41:44 +02:00
2024-04-03 02:04:18 +02:00
2023-02-09 15:24:15 +01:00
2023-02-18 09:56:40 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-04-16 11:38:26 -03:00
2024-04-03 02:04:20 +02:00
2023-02-09 15:24:15 +01:00
2025-12-03 20:27:08 +01:00
2026-05-16 18:17:39 +02:00
2026-05-16 18:17:40 +02:00
2023-02-09 15:24:15 +01:00
2026-05-16 18:17:56 +02:00
2022-09-24 17:57:36 +02:00
2022-03-15 09:42:31 -03:00
2023-01-16 09:59:31 +01:00
2022-12-01 11:21:14 +01:00
2022-09-05 08:13:57 +02:00
2022-09-05 08:00:57 +02:00
2023-02-09 15:24:15 +01:00
2024-04-03 02:04:18 +02:00
2022-11-22 22:59:51 +01:00
2023-02-09 15:24:15 +01:00
2025-12-03 20:27:08 +01:00
2023-02-16 01:18:45 +01:00
2023-01-12 20:52:37 +08:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2024-04-03 02:04:11 +02:00
2023-02-09 15:24:15 +01:00
2022-09-24 18:27:43 +02:00
2023-02-19 01:31:45 +08:00
2023-10-28 19:05:03 +02:00
2023-02-09 15:24:15 +01:00
2022-03-23 23:45:39 +01:00
2025-12-03 20:27:08 +01:00
2022-09-24 17:57:37 +02:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2022-10-23 20:45:25 +02:00
2025-12-03 20:27:08 +01:00
2023-10-28 19:05:03 +02:00
2026-05-16 18:17:41 +02:00
2025-12-03 20:27:08 +01:00
2022-12-01 11:21:15 +01:00
2022-09-22 17:44:05 +02:00
2023-02-09 15:24:15 +01:00
2024-04-03 02:04:17 +02:00
2022-12-01 11:21:14 +01:00
2023-02-09 15:24:15 +01:00
2024-04-03 02:04:18 +02:00
2022-09-03 15:41:44 +02:00
2023-02-09 15:24:15 +01:00
2023-10-28 19:04:57 +02:00
2022-11-03 21:16:03 +10:00
2023-02-16 01:18:45 +01:00
2025-12-31 17:58:37 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-01-09 12:14:47 -05:00
2023-02-09 15:24:15 +01:00
2022-09-30 19:11:36 +02:00
2024-04-04 20:55:27 +02:00
2023-01-31 14:29:08 +02:00
2023-02-09 15:24:15 +01:00
2024-04-03 02:04:21 +02:00
2023-02-09 15:24:15 +01:00
2023-10-28 19:04:51 +02:00
2023-02-09 15:24:15 +01:00
2023-11-03 23:33:46 +01:00
2023-02-09 15:24:15 +01:00
2024-03-19 21:18:07 +01:00
2023-02-09 15:24:15 +01:00
2023-02-11 21:29:35 +01:00
2024-04-03 02:04:23 +02:00
2023-02-09 15:24:15 +01:00
2022-12-01 11:21:14 +01:00
2023-02-09 15:24:15 +01:00
2022-10-21 21:12:45 +02:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2024-02-11 23:15:55 +01:00
2025-02-26 16:05:21 -07:00
2024-04-03 02:04:24 +02:00
2023-01-13 20:03:36 +08:00
2022-10-08 22:56:30 +08:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2024-04-03 02:04:25 +02:00
2023-02-19 22:50:32 +01:00
2023-02-09 15:24:15 +01:00
2025-12-03 20:27:08 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2024-03-19 21:18:07 +01:00
2024-04-04 21:10:40 +02:00
2023-02-09 15:24:15 +01:00
2023-01-12 10:44:16 +01:00
2023-02-09 15:24:15 +01:00
2022-09-25 14:56:03 +02:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2026-05-21 09:36:57 -05:00
2022-09-26 03:02:50 +02:00
2023-10-28 19:04:50 +02:00
2023-02-09 15:24:15 +01:00
2023-02-16 01:18:45 +01:00
2022-08-24 03:43:52 +02:00
2023-02-09 15:24:15 +01:00
2023-01-11 18:50:36 +08:00
2022-09-26 03:02:50 +02:00
2023-02-09 15:24:15 +01:00
2025-12-03 20:27:08 +01:00
2022-11-04 22:44:16 +01:00
2022-10-18 13:20:37 +11:00
2022-09-20 18:58:23 -03:00
2022-09-26 03:02:50 +02:00
2023-10-28 19:04:56 +02:00
2022-09-24 18:28:19 +02:00
2023-02-09 15:24:15 +01:00
2024-04-03 02:04:22 +02:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-10-28 20:15:29 +02:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2024-04-03 02:04:22 +02:00
2023-02-09 15:24:15 +01:00
2023-02-11 11:30:46 +01:00
2022-08-31 16:24:22 +02:00
2022-09-24 18:28:51 +02:00
2022-09-26 03:02:50 +02:00
2023-02-09 15:24:15 +01:00
2023-02-16 01:18:45 +01:00
2022-11-03 16:59:18 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-01-13 11:22:59 -06:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-16 01:18:45 +01:00
2023-01-26 23:31:44 +08:00
2023-10-28 20:15:29 +02:00
2023-10-28 20:15:29 +02:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2022-10-24 02:00:31 +02:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-16 01:18:45 +01:00
2026-05-16 18:17:56 +02:00
2022-10-04 23:47:54 +02:00
2023-02-09 15:24:15 +01:00
2022-12-01 11:21:14 +01:00
2022-11-17 10:05:49 -03:00
2022-11-17 10:05:49 -03:00
2024-04-03 02:04:17 +02:00
2023-02-25 21:20:11 +01:00
2024-04-03 02:04:22 +02:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2024-04-03 02:04:23 +02:00
2023-02-09 15:24:15 +01:00
2023-02-09 15:24:15 +01:00
2023-01-30 21:02:48 +01:00
2023-10-28 20:15:29 +02:00
2022-10-21 20:11:14 +02:00
2023-02-09 15:24:15 +01:00