This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch master
in repository ffmpeg.

commit 557ab6f2abe3dba995a66643fb6c200d058b8eea
Author:     Niklas Haas <[email protected]>
AuthorDate: Sun Jun 14 12:34:34 2026 +0200
Commit:     Niklas Haas <[email protected]>
CommitDate: Tue Jun 23 20:33:00 2026 +0200

    avformat/http: make short-seek logic more robust
    
    This avoids an underflow if short_seek is negative (which can happen if e.g.
    ffurl_get_short_seek() returns AVERROR(ENOSYS)), as well as a possible
    underflow if the read position is somehow past `range_end` (e.g. if the HTTP
    server malicously lied about the content range but gave us more bytes 
anyway)
    
    Sponsored-by: nxtedition AB
    Signed-off-by: Niklas Haas <[email protected]>
---
 libavformat/http.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/libavformat/http.c b/libavformat/http.c
index a0d84e5b09..e0dac4f8f8 100644
--- a/libavformat/http.c
+++ b/libavformat/http.c
@@ -2143,8 +2143,14 @@ static int64_t http_seek_internal(URLContext *h, int64_t 
off, int whence, int fo
     memcpy(old_buf, s->buf_ptr, old_buf_size);
 
     /* try to reuse existing connection for small seeks */
-    uint64_t remaining = s->range_end - old_off - old_buf_size;
-    if (s->hd && !s->willclose && s->range_end && remaining <= 
ffurl_get_short_seek(h)) {
+    int short_seek = ffurl_get_short_seek(h);
+    uint64_t old_read_pos = old_off + old_buf_size;
+    if (s->hd && !s->willclose && s->range_end && short_seek > 0 &&
+        old_read_pos + short_seek >= s->range_end)
+    {
+        uint64_t remaining = s->range_end - old_read_pos;
+        av_assert1(remaining <= short_seek);
+
         /* drain remaining data left on the wire from previous request */
         av_log(h, AV_LOG_DEBUG, "Soft-seeking to offset %"PRIu64" by draining "
                "%"PRIu64" remaining byte(s)\n", s->off, remaining);

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to