This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 01044d04536eec6e2f5f48ef404cf45d15feb461 Author: Steven Liu <[email protected]> AuthorDate: Thu Jul 9 13:04:34 2026 +0800 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Aug 2 02:47:29 2026 +0200 avformat/hls: Enforce protocol checks when opening child playlists Fix: vulnerability:019f3b84-903b-75fb-a8de-fad1c2d7e99c The parse_playlist() path for opening a new child playlist (in == NULL) directly called c->ctx->io_open(), bypassing the protocol whitelist and file-extension checks that open_url() enforces. This allowed child URLs from a master playlist to use protocols other than file/http/data or to have disallowed extensions. Route the !in branch through open_url() so that all child playlists are subject to the same security policy as segment URLs. Fixes a security bypass in HLS master playlist parsing. Found-by: depthfirst Signed-off-by: Steven Liu <[email protected]> (cherry picked from commit 23602df9cd1b485c45ba6f533d3b85569de3f323) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/hls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index e76e68ed51..0e1a1ba49c 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -857,7 +857,7 @@ static int parse_playlist(HLSContext *c, const char *url, if (c->http_persistent) av_dict_set(&opts, "multiple_requests", "1", 0); - ret = c->ctx->io_open(c->ctx, &in, url, AVIO_FLAG_READ, &opts); + ret = open_url(c->ctx, &in, url, &opts, NULL, NULL); av_dict_free(&opts); if (ret < 0) return ret; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
