This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 557ab6f2abe3dba995a66643fb6c200d058b8eea Author: Niklas Haas <[email protected]> AuthorDate: Sun Jun 14 12:34:34 2026 +0200 Commit: Niklas Haas <[email protected]> CommitDate: Tue Jun 23 20:33:00 2026 +0200 avformat/http: make short-seek logic more robust This avoids an underflow if short_seek is negative (which can happen if e.g. ffurl_get_short_seek() returns AVERROR(ENOSYS)), as well as a possible underflow if the read position is somehow past `range_end` (e.g. if the HTTP server malicously lied about the content range but gave us more bytes anyway) Sponsored-by: nxtedition AB Signed-off-by: Niklas Haas <[email protected]> --- libavformat/http.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libavformat/http.c b/libavformat/http.c index a0d84e5b09..e0dac4f8f8 100644 --- a/libavformat/http.c +++ b/libavformat/http.c @@ -2143,8 +2143,14 @@ static int64_t http_seek_internal(URLContext *h, int64_t off, int whence, int fo memcpy(old_buf, s->buf_ptr, old_buf_size); /* try to reuse existing connection for small seeks */ - uint64_t remaining = s->range_end - old_off - old_buf_size; - if (s->hd && !s->willclose && s->range_end && remaining <= ffurl_get_short_seek(h)) { + int short_seek = ffurl_get_short_seek(h); + uint64_t old_read_pos = old_off + old_buf_size; + if (s->hd && !s->willclose && s->range_end && short_seek > 0 && + old_read_pos + short_seek >= s->range_end) + { + uint64_t remaining = s->range_end - old_read_pos; + av_assert1(remaining <= short_seek); + /* drain remaining data left on the wire from previous request */ av_log(h, AV_LOG_DEBUG, "Soft-seeking to offset %"PRIu64" by draining " "%"PRIu64" remaining byte(s)\n", s->off, remaining); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
