PR #21646 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21646 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21646.patch
Found-by: 이동준 <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> From e60d4d38a26bc4e5845ecf82919ba8fa64efba93 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 4 Feb 2026 16:43:39 +0100 Subject: [PATCH] avformat/hls: Check for integer overflow with #EXTINF: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found-by: 이동준 <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/hls.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index 58650f717c..28c883097a 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -970,8 +970,13 @@ static int parse_playlist(HLSContext *c, const char *url, if (pls) pls->finished = 1; } else if (av_strstart(line, "#EXTINF:", &ptr)) { + double d = atof(ptr) * AV_TIME_BASE; + if (d < 0 || d > INT64_MAX || isnan(d)) { + av_log(c->ctx, AV_LOG_WARNING, "EXTINF %f unsupported\n", d / AV_TIME_BASE); + d = 0; + } + duration = d; is_segment = 1; - duration = atof(ptr) * AV_TIME_BASE; } else if (av_strstart(line, "#EXT-X-BYTERANGE:", &ptr)) { seg_size = strtoll(ptr, NULL, 10); ptr = strchr(ptr, '@'); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
