dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-08 17:11:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

avformat/hls: Enforce protocol checks when opening child playlists

Browse Source 
Fix: vulnerability:019f3b84-903b-75fb-a8de-fad1c2d7e99c
The parse_playlist() path for opening a new child playlist (in == NULL)
directly called c->ctx->io_open(), bypassing the protocol whitelist and
file-extension checks that open_url() enforces. This allowed child URLs
from a master playlist to use protocols other than file/http/data or to
have disallowed extensions.

Route the !in branch through open_url() so that all child playlists are
subject to the same security policy as segment URLs.

Fixes a security bypass in HLS master playlist parsing.

Found-by: depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 23602df9cd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Steven Liu
2026-07-09 13:04:34 +08:00
committed by Michael Niedermayer
parent f6c97aeadc
commit 01044d0453
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/hls.c
View File

@@ -857,7 +857,7 @@ static int parse_playlist(HLSContext *c, const char *url,
if (c->http_persistent)
av_dict_set(&opts, "multiple_requests", "1", 0);
ret = c->ctx->io_open(c->ctx, &in, url, AVIO_FLAG_READ, &opts);
ret = open_url(c->ctx, &in, url, &opts, NULL, NULL);
av_dict_free(&opts);
if (ret < 0)
return ret;