Change #286120

Comments

avformat/rtpenc_mpv: Do not read a picture header past the end of the packet
A packet ending in a picture start code made the temporal reference and
picture type be read from after the end of the packet.

This is not a security issue, the bytes read are in the padding that
muxer input is required to have, see ce1f4c78d1.

Fixes: read into padding
Fixes: FbXPpSfFS7Zp
Fixes: AISLE-2026-0111-00268
Read past the packet end Replicated through API with ASAN, using an unpadded packet
Wrong picture header Replicated through UnModified FFmpeg with the sample of trac ticket 6345
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

Changed files

• libavformat/rtpenc_mpv.c