Commit 94c3187ef7 for ffmpeg
commit 94c3187ef7384735b2902abb34a95cbe2400a159
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue Oct 6 23:17:58 2026 +0200
avformat/mmst: Fail when the ASF header has no packet size or no streams
The fix is the one recommended in the report.
Fixes: NULL pointer dereference
Fixes: 1eA5JUo2ED6K
Fixes: AISLE-2026-0111-00154
NULL pointer dereference Replicated through UnModified FFmpeg with ASAN,UBSAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
diff --git a/libavformat/mmst.c b/libavformat/mmst.c
index 59d3f9726e..78296a1f26 100644
--- a/libavformat/mmst.c
+++ b/libavformat/mmst.c
@@ -567,8 +567,10 @@ static int mms_open(URLContext *h, const char *uri, int flags)
}
mms->header_parsed = 1;
- if (!mms->asf_packet_len || !mms->stream_num)
+ if (!mms->asf_packet_len || !mms->stream_num) {
+ err = AVERROR_INVALIDDATA;
goto fail;
+ }
clear_stream_buffers(mms);
err = mms_safe_send_recv(mmst, send_stream_selection_request, SC_PKT_STREAM_ID_ACCEPTED);