Commit 17c3ea78ff for ffmpeg
commit 17c3ea78ff397037a7fcbdc8e710e286afb3728c
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu Oct 8 01:55:36 2026 +0200
avformat/nut: Store the side data palette in little endian
Fixes: xzy7SwiePKkh
Wrong palette Replicated through UnModified FFmpeg on s390x (qemu)
Found while testing the fixes for the security report AISLE-2026-0111-00173
diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c
index 7ec8526a06..ffb0a2a040 100644
--- a/libavformat/nutdec.c
+++ b/libavformat/nutdec.c
@@ -937,6 +937,9 @@ static int read_sm_data(AVFormatContext *s, AVIOContext *bc, AVPacket *pkt, int
if(!dst)
return AVERROR(ENOMEM);
avio_read(bc, dst, value_len);
+ if (HAVE_BIGENDIAN && !strcmp(name, "Palette"))
+ for (int j = 0; j + 4 <= value_len; j += 4)
+ AV_WN32(dst + j, AV_RL32(dst + j));
} else if (value == -3) {
value = get_s(bc);
} else if (value == -4) {
diff --git a/libavformat/nutenc.c b/libavformat/nutenc.c
index 5bf030cde3..4403cc1ed2 100644
--- a/libavformat/nutenc.c
+++ b/libavformat/nutenc.c
@@ -917,7 +917,12 @@ static int write_sm_data(AVFormatContext *s, AVIOContext *bc, AVPacket *pkt, int
put_s(dyn_bc, -2);
put_str(dyn_bc, "bin");
put_v(dyn_bc, size);
- avio_write(dyn_bc, data, size);
+ if (HAVE_BIGENDIAN && pkt->side_data[i].type == AV_PKT_DATA_PALETTE) {
+ for (int j = 0; j + 4 <= size; j += 4)
+ avio_wl32(dyn_bc, AV_RN32(data + j));
+ avio_write(dyn_bc, data + (size & ~3), size & 3);
+ } else
+ avio_write(dyn_bc, data, size);
sm_data_count++;
break;
case AV_PKT_DATA_PARAM_CHANGE: