Builder ffmpegsos-solaris10-sparc Build #12570

Results:

Failed shell_2 shell_3 shell_4 shell_5

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-ffmpegsos-solaris10-sparc' triggered this build

Steps and Logfiles:

1. git update ( 12 secs )
   1. stdio
2. shell 'gsed -i ...' ( 0 secs )
   1. stdio
3. shell_1 'gsed -i ...' ( 0 secs )
   1. stdio
4. shell_2 'gsed -i ...' failed ( 1 secs )
   1. stdio
5. shell_3 './configure --samples="../../../ffmpeg/fate-suite" ...' failed ( 15 secs )
   1. stdio
   2. config.log
6. shell_4 'gmake fate-rsync' failed ( 0 secs )
   1. stdio
7. shell_5 '../../../ffmpeg/fate.sh ../../../ffmpeg/fate_config_sos.sh' failed ( 0 secs )
   1. stdio
   2. configure.log
   3. compile.log
   4. test.log

Build Properties:

Forced Build Properties:

Responsible Users:

1. Ruikai Peng

   ruikaiohnoyoudont@pwno.io

Timing:

All Changes:

:

1. Change #252167

   Category	ffmpeg
   Changed by	Ruikai Peng <ruikaiohnoyoudont@pwno.io>
   Changed at	Sun 14 Dec 2025 18:42:59
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	16f89d342ebd5f726a5787e2e00069f339c7b446

   Comments

   avformat/mpegts: bounds-check JPEG-XS header_size before padding
   Regression since: 536475ea05.
   
   The JPEG-XS PES path trusted header_size from the payload and advanced
   pkt->data/pkt->size without validation, so the trailing memset could
   write out of bounds when header_size > pkt->size. Reject such packets,
   marking them corrupt and returning an error to avoid the OOB write.
   
   Repro (ASan):
   ASAN_OPTIONS=halt_on_error=1:detect_leaks=0   ./ffmpeg -v debug -nostdin -i poc-jpegxs.ts -copy_unknown -map 0   -c copy -f null /dev/null
   
   Crash in new_pes_packet memset on crafted TS with stream_id 0xbd,
   stream_type 0x32, header_size 0xFFFFFF00, payload starting with jxes.
   
   Found-by: Pwno

   Changed files

   • libavformat/mpegts.c