This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 0e5fd5f5f6f2007af6c21f7c91ca883043353dfc Author: Steven Liu <[email protected]> AuthorDate: Thu Jul 9 13:12:26 2026 +0800 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Aug 2 02:47:28 2026 +0200 avformat/hlsenc: Handle extensionless URIs in extract_segment_number() fix: vulnerability:019f3b84-90fb-737a-ae7a-b3e0219266fc extract_segment_number() used strrchr(filename, '.') and immediately did dot - 1 without checking for NULL. A segment URI with no extension would cause undefined behavior (NULL pointer arithmetic) when resuming an append_list playlist with subtitle variants. Add a NULL check and return -1 early when no dot is found. Fixes a crash/UB in HLS muxer resume path. Found-by: depthfirst Signed-off-by: Steven Liu <[email protected]> (cherry picked from commit 601d9ee881fbd9d9ff44466c561c480ff244eb9f) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/hlsenc.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/libavformat/hlsenc.c b/libavformat/hlsenc.c index 0b69ae4b3b..9db9294d03 100644 --- a/libavformat/hlsenc.c +++ b/libavformat/hlsenc.c @@ -1140,20 +1140,31 @@ static int hls_append_segment(struct AVFormatContext *s, HLSContext *hls, return 0; } -static int extract_segment_number(const char *filename) { +static int extract_segment_number(const char *filename) +{ const char *dot = strrchr(filename, '.'); - const char *num_start = dot - 1; + const char *num_start; + char *end; + long value; - while (num_start > filename && *num_start >= '0' && *num_start <= '9') { - num_start--; - } - - num_start++; + if (!dot) + return -1; + if (dot == filename) + return -1; + num_start = dot; + while (num_start > filename && + num_start[-1] >= '0' && num_start[-1] <= '9') + num_start--; if (num_start == dot) return -1; - return atoi(num_start); + errno = 0; + value = strtol(num_start, &end, 10); + if (errno == ERANGE || end != dot || value > INT_MAX) + return -1; + + return (int)value; } static int parse_playlist(AVFormatContext *s, const char *url, VariantStream *vs) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
