Skip to content

Make FFmpeg MP4 diagnostics format-safe - #2314

Open
Guflly wants to merge 1 commit into
CCExtractor:masterfrom
Guflly:fix-mp4-mprint-format-2312
Open

Make FFmpeg MP4 diagnostics format-safe#2314
Guflly wants to merge 1 commit into
CCExtractor:masterfrom
Guflly:fix-mp4-mprint-format-2312

Conversation

@Guflly

@Guflly Guflly commented Aug 11, 2026

Copy link
Copy Markdown

This routes FFmpeg MP4 diagnostic text through a literal %s format before calling mprint, so filenames and error text cannot be interpreted as format specifiers. It covers every diagnostic in the Rust MP4 demuxer and adds a regression case with %s%n in the message.

Tests:

  • cargo check --manifest-path src/rust/Cargo.toml --tests
  • focused format-contract test (1 passed)
  • focused clippy check with warnings denied
  • cargo fmt --manifest-path src/rust/Cargo.toml --all -- --check

Fixes #2312

@ccextractor-bot

Copy link
Copy Markdown
Collaborator
CCExtractor CI platform finished running the test files on linux. Below is a summary of the test results, when compared to test for commit 6077cf5...:
Report Name Tests Passed
Broken 9/13
CEA-708 2/14
DVB 0/7
DVD 3/3
DVR-MS 2/2
General 22/27
Hardsubx 1/1
Hauppage 3/3
MP4 3/3
NoCC 10/10
Options 69/86
Teletext 0/21
WTV 12/13
XDS 31/34

Your PR breaks these cases:

NOTE: The following tests have been failing on the master branch as well as the PR:


It seems that not all tests were passed completely. This is an indication that the output of some files is not as expected (but might be according to you).

Check the result page for more info.

@ccextractor-bot

Copy link
Copy Markdown
Collaborator
CCExtractor CI platform finished running the test files on windows. Below is a summary of the test results, when compared to test for commit c328108...:
Report Name Tests Passed
Broken 9/13
CEA-708 2/14
DVB 0/7
DVD 3/3
DVR-MS 2/2
General 22/27
Hardsubx 1/1
Hauppage 3/3
MP4 3/3
NoCC 10/10
Options 69/86
Teletext 0/21
WTV 12/13
XDS 31/34

Your PR breaks these cases:

NOTE: The following tests have been failing on the master branch as well as the PR:


It seems that not all tests were passed completely. This is an indication that the output of some files is not as expected (but might be according to you).

Check the result page for more info.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Format string vulnerability (crash, CWE-134) in FFmpeg MP4 demuxer — filename passed directly as mprint() format string

2 participants