Commit 112b0bbab2 for ffmpeg
commit 112b0bbab237b937921b8e4356699095743f63df
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue Oct 6 23:23:11 2026 +0200
avformat/gxfenc: Do not read past the end of MPEG-2 packets shorter than 2 bytes
Checking the index before the read was suggested in the report.
Fixes: NULL pointer dereference
Fixes: mOGFdmxuya4M
Fixes: AISLE-2026-0111-00065
NULL pointer dereference Replicated through API with ASAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
diff --git a/libavformat/gxfenc.c b/libavformat/gxfenc.c
index 023c20d4e5..9bba49ab74 100644
--- a/libavformat/gxfenc.c
+++ b/libavformat/gxfenc.c
@@ -878,7 +878,7 @@ static int gxf_parse_mpeg_frame(GXFStreamContext *sc, const uint8_t *buf, int si
if(c == 0x1B8 && sc->first_gop_closed == -1) /* GOP start code */
sc->first_gop_closed= (buf[i+4]>>6)&1;
}
- return (buf[i+1]>>3)&7;
+ return i + 1 < size ? (buf[i+1]>>3)&7 : 0;
}
static int gxf_write_media_preamble(AVFormatContext *s, AVPacket *pkt, int size)