This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 4127eb2d6ab0008b4c7a347fffef42b467c88f5b Author: Niklas Haas <[email protected]> AuthorDate: Tue Jun 23 15:43:11 2026 +0200 Commit: Kacper Michajłow <[email protected]> CommitDate: Mon Jul 27 17:05:20 2026 +0000 avformat/libcurl: avoid TOCTOU in libcurl_seek() If this triggers while an asynchronous header_callback() (e.g. from a previous seek or redirect) is still running, the seekable/content_size fields can be written to while libcurl_seek() is still reading from them. I'm not convinced this is an actual bug in practice, but tsan at least is bound to complain about it. Sponsored-by: nxtedition AB Signed-off-by: Niklas Haas <[email protected]> --- libavformat/libcurl.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/libavformat/libcurl.c b/libavformat/libcurl.c index b747ccc940..a8b8245610 100644 --- a/libavformat/libcurl.c +++ b/libavformat/libcurl.c @@ -919,10 +919,15 @@ static int64_t libcurl_seek(URLContext *h, int64_t pos, int whence) CurlContext *c = h->priv_data; int64_t newpos; + pthread_mutex_lock(&c->mutex); + const int64_t content_size = c->content_size; + const int seekable = c->seekable; + pthread_mutex_unlock(&c->mutex); + if (whence == AVSEEK_SIZE) - return c->content_size >= 0 ? c->content_size : AVERROR(ENOSYS); + return content_size >= 0 ? content_size : AVERROR(ENOSYS); - if (!c->seekable) + if (!seekable) return AVERROR(ENOSYS); switch (whence) { @@ -933,9 +938,9 @@ static int64_t libcurl_seek(URLContext *h, int64_t pos, int whence) newpos = c->logical_pos + pos; break; case SEEK_END: - if (c->content_size < 0) + if (content_size < 0) return AVERROR(ENOSYS); - newpos = c->content_size + pos; + newpos = content_size + pos; break; default: return AVERROR(EINVAL); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
