On 13/01/16 18:46, Rémi Denis-Courmont wrote: > How and to whom? I fail to see a bug.
In a moderately convoluted way one can upload a m3u8 that references to the concatenation of a playlist and the file you want to leak the playlist concatenated to the file forms a http://rogueserver/steal?thefileuntilanendlineormaxurllenght so you can pass some content of the file through that GET. Since I got a report on security@ I just baked this patch to make easier to restrict the supported protocols. One might use it to blacklist http to prefer the https variants in certain scenarios. lu _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
