PR #23164 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23164
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23164.patch

None of these have demonstrated security impact

Found-by: jiale yao
Signed-off-by: Michael Niedermayer <[email protected]>


>From e728e3ee64c6e8cf0e13be488532dbe3a3229df1 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Wed, 20 May 2026 01:24:54 +0200
Subject: [PATCH 1/2] avformat/hls: Check TIME-OFFSET value

Fixes: UB with out of range values
Fixes: poc_overflow.m3u8

Found-by: jiale yao
Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavformat/hls.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index 29dc08ef1f..9a4c6304e7 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -957,9 +957,14 @@ static int parse_playlist(HLSContext *c, const char *url,
                 goto fail;
             }
             if (av_strstart(ptr, "TIME-OFFSET=", &time_offset_value)) {
-                float offset = strtof(time_offset_value, NULL);
-                pls->start_time_offset = offset * AV_TIME_BASE;
-                pls->time_offset_flag = 1;
+                double offset = strtod(time_offset_value, NULL) * AV_TIME_BASE;
+                if (offset >= -0x1p63 && offset < 0x1p63) {
+                    pls->start_time_offset = offset;
+                    pls->time_offset_flag = 1;
+                } else {
+                    av_log(c->ctx, AV_LOG_WARNING, "TIME-OFFSET value is"
+                                                    "invalid, it will be 
ignored");
+                }
             } else {
                 av_log(c->ctx, AV_LOG_WARNING, "#EXT-X-START value is"
                                                 "invalid, it will be ignored");
-- 
2.52.0


>From 4a9cbc6ba4132f3bc41a98404e5a3f9bb41c3629 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Wed, 20 May 2026 01:35:17 +0200
Subject: [PATCH 2/2] avformat/hls: Check url_offset and size

Fixes: integer overflow

Found-by: jiale yao
Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavformat/hls.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index 9a4c6304e7..b03201c690 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -454,6 +454,11 @@ static struct segment *new_init_section(struct playlist 
*pls,
         ptr = strchr(info->byterange, '@');
         if (ptr)
             sec->url_offset = strtoll(ptr+1, NULL, 10);
+        if (sec->size < 0 || sec->url_offset < 0 || sec->size > INT64_MAX - 
sec->url_offset) {
+            av_freep(&sec->url);
+            av_free(sec);
+            return NULL;
+        }
     } else {
         /* the entire file is the init section */
         sec->size = -1;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to