This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.1 in repository ffmpeg.
commit b06f79094a636887076dee4074ef6d3818e5556b Author: Steven Liu <[email protected]> AuthorDate: Thu Jul 9 13:01:31 2026 +0800 Commit: Michael Niedermayer <[email protected]> CommitDate: Sat Sep 19 14:26:58 2026 +0200 avformat/hlsenc: Fix heap buffer overflow in parse_playlist() Fix: vulnerability:019f3b84-903b-75fb-a8de-fe6f84d6bc32 When parsing IV=0x... followed by a comma, end - ptr was passed directly to av_strlcpy() as the destination size. Since iv_string is only 33 bytes (KEYSIZE*2 + 1), a long IV token could overflow into adjacent heap data. Use FFMIN(end - ptr + 1, sizeof(buf)) to cap the copy size to the actual buffer size. Apply the same fix to key_uri parsing for consistency. Fixes a heap buffer overflow in append_list mode when reading an existing playlist with a crafted IV or URI token length. Found-by: depthfirst Signed-off-by: Steven Liu <[email protected]> (cherry picked from commit 275e217b10057e812039c722d420b3ba996ae69a) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/hlsenc.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/libavformat/hlsenc.c b/libavformat/hlsenc.c index e2c2d1a798..e6bb749c73 100644 --- a/libavformat/hlsenc.c +++ b/libavformat/hlsenc.c @@ -30,6 +30,7 @@ #include "libavutil/attributes_internal.h" #include "libavutil/avassert.h" +#include "libavutil/macros.h" #include "libavutil/mathematics.h" #include "libavutil/avstring.h" #include "libavutil/bprint.h" @@ -1201,11 +1202,13 @@ static int parse_playlist(AVFormatContext *s, const char *url, VariantStream *vs ptr = av_stristr(line, "URI=\""); if (ptr) { ptr += strlen("URI=\""); - end = av_stristr(ptr, ","); + end = strchr(ptr, '"'); if (end) { - av_strlcpy(vs->key_uri, ptr, end - ptr); + av_strlcpy(vs->key_uri, ptr, + FFMIN(end - ptr + 1, sizeof(vs->key_uri))); } else { - av_strlcpy(vs->key_uri, ptr, sizeof(vs->key_uri)); + ret = AVERROR_INVALIDDATA; + goto fail; } } @@ -1214,7 +1217,7 @@ static int parse_playlist(AVFormatContext *s, const char *url, VariantStream *vs ptr += strlen("IV=0x"); end = av_stristr(ptr, ","); if (end) { - av_strlcpy(vs->iv_string, ptr, end - ptr); + av_strlcpy(vs->iv_string, ptr, FFMIN(end - ptr + 1, sizeof(vs->iv_string))); } else { av_strlcpy(vs->iv_string, ptr, sizeof(vs->iv_string)); } -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
