This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit f6c97aeadc33c82e17f0ef2dda916cb355f8940e Author: Steven Liu <[email protected]> AuthorDate: Thu Jul 9 13:01:31 2026 +0800 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Aug 2 02:47:28 2026 +0200 avformat/hlsenc: Fix heap buffer overflow in parse_playlist() Fix: vulnerability:019f3b84-903b-75fb-a8de-fe6f84d6bc32 When parsing IV=0x... followed by a comma, end - ptr was passed directly to av_strlcpy() as the destination size. Since iv_string is only 33 bytes (KEYSIZE*2 + 1), a long IV token could overflow into adjacent heap data. Use FFMIN(end - ptr + 1, sizeof(buf)) to cap the copy size to the actual buffer size. Apply the same fix to key_uri parsing for consistency. Fixes a heap buffer overflow in append_list mode when reading an existing playlist with a crafted IV or URI token length. Found-by: depthfirst Signed-off-by: Steven Liu <[email protected]> (cherry picked from commit 275e217b10057e812039c722d420b3ba996ae69a) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/hlsenc.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/libavformat/hlsenc.c b/libavformat/hlsenc.c index 9db9294d03..50f19f9694 100644 --- a/libavformat/hlsenc.c +++ b/libavformat/hlsenc.c @@ -30,6 +30,7 @@ #include "libavutil/attributes_internal.h" #include "libavutil/avassert.h" +#include "libavutil/macros.h" #include "libavutil/mathematics.h" #include "libavutil/avstring.h" #include "libavutil/bprint.h" @@ -1211,11 +1212,13 @@ static int parse_playlist(AVFormatContext *s, const char *url, VariantStream *vs ptr = av_stristr(line, "URI=\""); if (ptr) { ptr += strlen("URI=\""); - end = av_stristr(ptr, ","); + end = strchr(ptr, '"'); if (end) { - av_strlcpy(vs->key_uri, ptr, end - ptr); + av_strlcpy(vs->key_uri, ptr, + FFMIN(end - ptr + 1, sizeof(vs->key_uri))); } else { - av_strlcpy(vs->key_uri, ptr, sizeof(vs->key_uri)); + ret = AVERROR_INVALIDDATA; + goto fail; } } @@ -1224,7 +1227,7 @@ static int parse_playlist(AVFormatContext *s, const char *url, VariantStream *vs ptr += strlen("IV=0x"); end = av_stristr(ptr, ","); if (end) { - av_strlcpy(vs->iv_string, ptr, end - ptr); + av_strlcpy(vs->iv_string, ptr, FFMIN(end - ptr + 1, sizeof(vs->iv_string))); } else { av_strlcpy(vs->iv_string, ptr, sizeof(vs->iv_string)); } _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
