This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch master
in repository ffmpeg.

commit 2a6514b7c4bbc67b1458caf306e742a121088976
Author:     Niklas Haas <[email protected]>
AuthorDate: Mon Jun 29 16:33:37 2026 +0200
Commit:     Kacper Michajłow <[email protected]>
CommitDate: Mon Jul 27 17:05:20 2026 +0000

    avformat/libcurl: harden against malicious underflow
    
    If the server sends a value of INT64_MIN here, we would correctly parse
    it and then subtract off -1, underflowing to a huge positive value
    (and triggering undefined behavior in the process).
    
    Sponsored-by: nxtedition AB
    Signed-off-by: Niklas Haas <[email protected]>
---
 libavformat/libcurl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavformat/libcurl.c b/libavformat/libcurl.c
index 2f3a00dbb9..7783b1aaad 100644
--- a/libavformat/libcurl.c
+++ b/libavformat/libcurl.c
@@ -332,7 +332,7 @@ static size_t header_callback(char *ptr, size_t size, 
size_t nitems, void *userd
             if (c->hdr_content_end >= 0)
                 c->request_end = c->hdr_content_end;
             else
-                c->request_end = c->content_size - 1;
+                c->request_end = c->content_size > 0 ? c->content_size - 1 : 
-1;
         }
     } else {
         c->stream_ok = 0;
@@ -453,7 +453,7 @@ static void on_done(CurlContext *c, CURLcode code)
 
     if (code == CURLE_OK && !aborted && c->stream_ok) {
         c->retry_count = 0;
-        int64_t file_end = c->content_size - 1;
+        int64_t file_end = c->content_size > 0 ? c->content_size - 1 : -1;
         if (c->end_off > 0)
             file_end = FFMIN(file_end, c->end_off - 1);
         if (c->seekable && c->request_end >= 0 && c->request_end < file_end) {

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to