This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit d377212904a19fc740d721cbda0ba58fa3805a29 Author: Joshua Rogers <[email protected]> AuthorDate: Sun Sep 6 14:55:59 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Thu Sep 17 01:30:42 2026 +0200 avformat/tls_mbedtls: set the expected hostname for numeric hosts For IP-literal hosts mbedtls_ssl_set_hostname() was skipped, so a CA-trusted certificate for an unrelated name was accepted with no CN/SAN check. Set the name for numeric hosts too; mbedTLS matches IP literals against iPAddress SANs. Fixes: certificate host mismatch accepted for IP-literal hosts (CWE-297) Fixes: oLS26nsaOqUr Found-by: Joshua Rogers <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 57a2e704b4a6eda5d061b45aacde6b19c026bfc0) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/tls_mbedtls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/tls_mbedtls.c b/libavformat/tls_mbedtls.c index 8f7ace5e63..444148be8a 100644 --- a/libavformat/tls_mbedtls.c +++ b/libavformat/tls_mbedtls.c @@ -673,7 +673,7 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op goto fail; } - if (!shr->listen && !shr->numerichost) { + if (!shr->listen) { if ((ret = mbedtls_ssl_set_hostname(&tls_ctx->ssl_context, shr->host)) != 0) { av_log(h, AV_LOG_ERROR, "mbedtls_ssl_set_hostname returned %d\n", ret); goto fail; -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
