Commit 9415575f33 for ffmpeg
commit 9415575f33b6b560a1f55197f358f48375c82122
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri Oct 2 19:54:18 2026 +0200
avformat/rtpenc_rfc4175: Do not send partially filled packets
If the input packet ended before the data of a segment, the copy loop
stopped but the RTP packet was still sent with the size of all its
segments. The part of the payload that was not copied contained
uninitialized memory of the packet buffer or data of the previous
packet.
Fixes: read of uninitialized memory
Fixes: TluGFwVC22dC
Found during triage of the security report fKcw8qCE1cYW
Replicated through UnModified FFmpeg
diff --git a/libavformat/rtpenc_rfc4175.c b/libavformat/rtpenc_rfc4175.c
index 2bfbfaa88e..4fd5fbda9d 100644
--- a/libavformat/rtpenc_rfc4175.c
+++ b/libavformat/rtpenc_rfc4175.c
@@ -134,7 +134,7 @@ void ff_rtp_send_raw_rfc4175(AVFormatContext *s1, const uint8_t *buf, int size,
l_line = 2 * l_line + l_field;
copy_offset = (l_line * (int64_t)width + l_off) * pgroup / xinc;
if (copy_offset + length > size)
- break;
+ return;
memcpy (dest, buf + copy_offset, length);
dest += length;
} while (cont);