PR #23164 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23164 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23164.patch
None of these have demonstrated security impact Found-by: jiale yao Signed-off-by: Michael Niedermayer <[email protected]> >From e728e3ee64c6e8cf0e13be488532dbe3a3229df1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 20 May 2026 01:24:54 +0200 Subject: [PATCH 1/2] avformat/hls: Check TIME-OFFSET value Fixes: UB with out of range values Fixes: poc_overflow.m3u8 Found-by: jiale yao Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/hls.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index 29dc08ef1f..9a4c6304e7 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -957,9 +957,14 @@ static int parse_playlist(HLSContext *c, const char *url, goto fail; } if (av_strstart(ptr, "TIME-OFFSET=", &time_offset_value)) { - float offset = strtof(time_offset_value, NULL); - pls->start_time_offset = offset * AV_TIME_BASE; - pls->time_offset_flag = 1; + double offset = strtod(time_offset_value, NULL) * AV_TIME_BASE; + if (offset >= -0x1p63 && offset < 0x1p63) { + pls->start_time_offset = offset; + pls->time_offset_flag = 1; + } else { + av_log(c->ctx, AV_LOG_WARNING, "TIME-OFFSET value is" + "invalid, it will be ignored"); + } } else { av_log(c->ctx, AV_LOG_WARNING, "#EXT-X-START value is" "invalid, it will be ignored"); -- 2.52.0 >From 4a9cbc6ba4132f3bc41a98404e5a3f9bb41c3629 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 20 May 2026 01:35:17 +0200 Subject: [PATCH 2/2] avformat/hls: Check url_offset and size Fixes: integer overflow Found-by: jiale yao Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/hls.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/hls.c b/libavformat/hls.c index 9a4c6304e7..b03201c690 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -454,6 +454,11 @@ static struct segment *new_init_section(struct playlist *pls, ptr = strchr(info->byterange, '@'); if (ptr) sec->url_offset = strtoll(ptr+1, NULL, 10); + if (sec->size < 0 || sec->url_offset < 0 || sec->size > INT64_MAX - sec->url_offset) { + av_freep(&sec->url); + av_free(sec); + return NULL; + } } else { /* the entire file is the init section */ sec->size = -1; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
