Builder ffmpegsos-solaris10-i386 Build #13666

Results:

Failed shell_2 shell_3 shell_4 shell_5

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-ffmpegsos-solaris10-i386' triggered this build

Steps and Logfiles:

1. git update ( 4 secs )
   1. stdio
2. shell 'gsed -i ...' ( 0 secs )
   1. stdio
3. shell_1 'gsed -i ...' ( 0 secs )
   1. stdio
4. shell_2 'gsed -i ...' failed ( 0 secs )
   1. stdio
5. shell_3 './configure --samples="../../../ffmpeg/fate-suite" ...' failed ( 7 secs )
   1. stdio
   2. config.log
6. shell_4 'gmake fate-rsync' failed ( 0 secs )
   1. stdio
7. shell_5 '../../../ffmpeg/fate.sh ../../../ffmpeg/fate_config_sos.sh' failed ( 0 secs )
   1. stdio
   2. configure.log
   3. compile.log
   4. test.log

Build Properties:

Forced Build Properties:

Responsible Users:

1. Ruikai Peng

   ruikaiohnoyoudont@pwno.io

Timing:

All Changes:

:

1. Change #263308

   Category	ffmpeg
   Changed by	Ruikai Peng <ruikaiohnoyoudont@pwno.io>
   Changed at	Thu 02 Apr 2026 14:19:09
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	7466d8a8509bcb2f54e4f9e149bded8f413b6e46

   Comments

   avformat/whip: check RTP history packet size before RTX retransmission
   handle_rtx_packet() constructs an RTX packet by shifting the payload
   of a history entry to insert the original sequence number. It uses
   memmove with length (ori_size - 12), but never checks that ori_size
   is at least 12 bytes (the minimum RTP header size).
   
   Zero-initialized history slots have seq == 0 and size == 0.
   rtp_history_find() only compares sequence numbers, so an RTCP NACK
   requesting seq 0 early in a session matches such a slot. The
   subtraction then wraps to a huge value when converted to size_t,
   causing a stack buffer overflow in memmove().
   
   Add a little size check to reject history entries smaller than and
   valid RTP header before any arithmetic on their size.
   
   Found-by: Pwno

   Changed files

   • libavformat/whip.c