ffmpegx: avcodec/hw_base_encode: fix NULL dereference if no frames before end-of-stream

- https://patchwork.ffmpeg.org/series/15013/mbox/ - https://patchwork.ffmpeg.org/project/ffmpeg/patch/20250719070836.283597-1-jahutchinson99@googlemail.com/ - https://github.com/tvheadend/tvheadend/issues/1833
2025-09-24 19:46:01 +07:00 · 2025-09-16 13:41:43 +00:00
parent a77f02895c
commit b0b0e0fe07
1 changed files with 103 additions and 0 deletions
--- a/packages/addons/addon-depends/ffmpegx/patches/ffmpeg-0001-fix-NULL-dereference-if-no-frames-before-end-of-stream.patch
+++ b/packages/addons/addon-depends/ffmpegx/patches/ffmpeg-0001-fix-NULL-dereference-if-no-frames-before-end-of-stream.patch
@@ -0,0 +1,103 @@
+From patchwork Sat Jul 19 07:08:36 2025
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: James Hutchinson <jahutchinson99@googlemail.com>
+X-Patchwork-Id: 56391
+Return-Path: <ffmpeg-devel-bounces@ffmpeg.org>
+X-Original-To: ffmpeg-patchwork@ffmpeg.org
+Delivered-To: ffmpeg-patchwork@ffmpeg.org
+Received: from [127.0.1.1] (localhost [127.0.0.1])
+	by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id DE79168C231;
+	Sat, 19 Jul 2025 10:09:04 +0300 (EEST)
+X-Original-To: ffmpeg-devel@ffmpeg.org
+Delivered-To: ffmpeg-devel@ffmpeg.org
+Received: from mail-ej1-f52.google.com (mail-ej1-f52.google.com
+ [209.85.218.52])
+ by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 9A95468BDD6
+ for <ffmpeg-devel@ffmpeg.org>; Sat, 19 Jul 2025 10:08:58 +0300 (EEST)
+Received: by mail-ej1-f52.google.com with SMTP id
+ a640c23a62f3a-ae0b2ead33cso479703566b.0
+ for <ffmpeg-devel@ffmpeg.org>; Sat, 19 Jul 2025 00:08:58 -0700 (PDT)
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+ d=1e100.net; s=20230601; t=1752908937; x=1753513737;
+ h=content-transfer-encoding:mime-version:message-id:date:subject:cc
+ :to:from:x-gm-message-state:from:to:cc:subject:date:message-id
+ :reply-to;
+ bh=2dgePZ7nkFD/l9ba1w+iqvJ6bPcp8CnRMMdiL89sQjs=;
+ b=fxolVU0f6lC0bG62RAIWwzdNb0Ppc0I5FcIyXCD5S/BUbkyRidOe9gUQMdM6tyeQke
+ EYPR6GppfEhkNYOrO09L7D8eFUpmaVPXsDt24HP3SAl1bDoEZNzV6N+emcefHoAtedUR
+ 59bMG7xU/DrhH1zVncryNMzReTZMTzkkFg1rK3jpcSpXRjsUHd3Eeyp5a05TMZDQhjYk
+ Gs1Qp3ceFgKX7Awinhu7EtqpCSmjwsJkkqPKberRQO5UWXdBTU9n4lwKKbq8pE3tDRk9
+ 4jOwcrm1q4MGkB651KZO9uqJ4d926eUoyNgg1+5dMVI6WM0NXDWTd/SGUzNev1XHi95e
+ EG8w==
+X-Gm-Message-State: AOJu0YwfLUWzpx354L+DikUVlulayk7JaPxt4+5IcAk7h+4Tw0vmjQJj
+ pR04G7AQ7uHdjZfFDelg2ysc2vqWfZGi7nquGv95cEtNvVSmgvUloWiGZms7lQ==
+X-Gm-Gg: ASbGncveUGNDyMLnqtJmHj5HXzox/EZLHd4frYqSlTnViB3dlI326N2JlbHOMaJSntE
+ wBoDnCvmXESMt/FG7vsvHl6qfLXdF80ZJUbMrVDMtvz2iSMl5vpXCM7EQFNEgreGEUclG11RZ4B
+ nHBYO+swzV/yx293i5VqeEfmQGq4XChY8OjQZG8hwtowYnsvgqut0/G7kLtnaty2BEWklG/s5iW
+ Q4GZyJ7cfmiqfWGejZsD24Q1sFGQFd9iWef3tW0XNeotu3G2pWFP/BiGr07HgR2Motb5c+HnVFw
+ 1xgoKFUUa30G1lRjBTQqhIudGa2UWAhiaPFhHjvkbxG9TKV+cCblsVuq1hZKEXeYN9hahIw0jRp
+ qWIXTuzp8PjqqIKiscruZb7CIC6eTzEoO4EYPCk/hNqA=
+X-Google-Smtp-Source: 
+ AGHT+IFBbNh6HR778NSqbSozK3zA6zgI09LiaJY3EpoIFGzahtWIAa16h5k79lnzQGZqPjn8qMYedg==
+X-Received: by 2002:a17:906:d7c7:b0:ae0:7e95:fb with SMTP id
+ a640c23a62f3a-aec65abd4a4mr609160766b.5.1752908937148;
+ Sat, 19 Jul 2025 00:08:57 -0700 (PDT)
+Received: from mediapc.localdomain ([193.28.38.52])
+ by smtp.gmail.com with ESMTPSA id
+ a640c23a62f3a-aec6c79cd11sm252704466b.16.2025.07.19.00.08.56
+ (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+ Sat, 19 Jul 2025 00:08:56 -0700 (PDT)
+To: ffmpeg-devel@ffmpeg.org
+Date: Sat, 19 Jul 2025 08:08:36 +0100
+Message-ID: <20250719070836.283597-1-jahutchinson99@googlemail.com>
+X-Mailer: git-send-email 2.50.1
+MIME-Version: 1.0
+Subject: [FFmpeg-devel] [PATCH] avcodec/hw_base_encode: fix NULL dereference
+ if no frames before end-of-stream
+X-BeenThere: ffmpeg-devel@ffmpeg.org
+X-Mailman-Version: 2.1.29
+Precedence: list
+List-Id: FFmpeg development discussions and patches <ffmpeg-devel.ffmpeg.org>
+List-Unsubscribe: <https://ffmpeg.org/mailman/options/ffmpeg-devel>,
+ <mailto:ffmpeg-devel-request@ffmpeg.org?subject=unsubscribe>
+List-Archive: <https://ffmpeg.org/pipermail/ffmpeg-devel>
+List-Post: <mailto:ffmpeg-devel@ffmpeg.org>
+List-Help: <mailto:ffmpeg-devel-request@ffmpeg.org?subject=help>
+List-Subscribe: <https://ffmpeg.org/mailman/listinfo/ffmpeg-devel>,
+ <mailto:ffmpeg-devel-request@ffmpeg.org?subject=subscribe>
+X-Patchwork-Original-From: James Hutchinson via ffmpeg-devel
+ <ffmpeg-devel@ffmpeg.org>
+From: James Hutchinson <jahutchinson99@googlemail.com>
+Reply-To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
+Cc: James Hutchinson <jahutchinson99@googlemail.com>
+Errors-To: ffmpeg-devel-bounces@ffmpeg.org
+Sender: "ffmpeg-devel" <ffmpeg-devel-bounces@ffmpeg.org>
+
+If hw_base_encode_send_frame() is called with frame == NULL before any
+input frames are submitted, ctx->pic_end is NULL and dereferencing it
+causes a crash. This can occur in hardware encoding pipelines that flush
+before receiving any input frames.
+
+Fix by checking ctx->pic_end before accessing its pts field.
+
+Link: https://github.com/tvheadend/tvheadend/issues/1833
+Signed-off-by: James Hutchinson <jahutchinson99@googlemail.com>
+---
+ libavcodec/hw_base_encode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libavcodec/hw_base_encode.c b/libavcodec/hw_base_encode.c
+index 33a30c8d10..7aa8aeedb1 100644
+--- a/libavcodec/hw_base_encode.c
+++ b/libavcodec/hw_base_encode.c
+@@ -504,7 +504,7 @@ static int hw_base_encode_send_frame(AVCodecContext *avctx, FFHWBaseEncodeContex
+ 
+         // Fix timestamps if we hit end-of-stream before the initial decode
+         // delay has elapsed.
+-        if (ctx->input_order <= ctx->decode_delay)
+        if (ctx->input_order <= ctx->decode_delay && ctx->pic_end)
+             ctx->dts_pts_diff = ctx->pic_end->pts - ctx->first_pts;
+     }
+