This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch master
in repository ffmpeg.

commit 4127eb2d6ab0008b4c7a347fffef42b467c88f5b
Author:     Niklas Haas <[email protected]>
AuthorDate: Tue Jun 23 15:43:11 2026 +0200
Commit:     Kacper Michajłow <[email protected]>
CommitDate: Mon Jul 27 17:05:20 2026 +0000

    avformat/libcurl: avoid TOCTOU in libcurl_seek()
    
    If this triggers while an asynchronous header_callback() (e.g. from a 
previous
    seek or redirect) is still running, the seekable/content_size fields can
    be written to while libcurl_seek() is still reading from them.
    
    I'm not convinced this is an actual bug in practice, but tsan at least is
    bound to complain about it.
    
    Sponsored-by: nxtedition AB
    Signed-off-by: Niklas Haas <[email protected]>
---
 libavformat/libcurl.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/libavformat/libcurl.c b/libavformat/libcurl.c
index b747ccc940..a8b8245610 100644
--- a/libavformat/libcurl.c
+++ b/libavformat/libcurl.c
@@ -919,10 +919,15 @@ static int64_t libcurl_seek(URLContext *h, int64_t pos, 
int whence)
     CurlContext *c = h->priv_data;
     int64_t newpos;
 
+    pthread_mutex_lock(&c->mutex);
+    const int64_t content_size = c->content_size;
+    const int seekable = c->seekable;
+    pthread_mutex_unlock(&c->mutex);
+
     if (whence == AVSEEK_SIZE)
-        return c->content_size >= 0 ? c->content_size : AVERROR(ENOSYS);
+        return content_size >= 0 ? content_size : AVERROR(ENOSYS);
 
-    if (!c->seekable)
+    if (!seekable)
         return AVERROR(ENOSYS);
 
     switch (whence) {
@@ -933,9 +938,9 @@ static int64_t libcurl_seek(URLContext *h, int64_t pos, int 
whence)
         newpos = c->logical_pos + pos;
         break;
     case SEEK_END:
-        if (c->content_size < 0)
+        if (content_size < 0)
             return AVERROR(ENOSYS);
-        newpos = c->content_size + pos;
+        newpos = content_size + pos;
         break;
     default:
         return AVERROR(EINVAL);

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to