dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-09 01:21:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

avformat/hlsenc: Fix heap buffer overflow in parse_playlist()

Browse Source 
Fix: vulnerability:019f3b84-903b-75fb-a8de-fe6f84d6bc32

When parsing IV=0x... followed by a comma, end - ptr was passed directly
to av_strlcpy() as the destination size. Since iv_string is only 33 bytes
(KEYSIZE*2 + 1), a long IV token could overflow into adjacent heap data.

Use FFMIN(end - ptr + 1, sizeof(buf)) to cap the copy size to the actual
buffer size. Apply the same fix to key_uri parsing for consistency.

Fixes a heap buffer overflow in append_list mode when reading an existing
playlist with a crafted IV or URI token length.

Found-by: depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
This commit is contained in:
Steven Liu
2026-07-09 13:01:31 +08:00
committed by stevenliu
parent b52c71e438
commit 275e217b10
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
libavformat/hlsenc.c
View File

@@ -30,6 +30,7 @@
#include "libavutil/attributes_internal.h"
#include "libavutil/avassert.h"
#include "libavutil/macros.h"
#include "libavutil/mathematics.h"
#include "libavutil/avstring.h"
#include "libavutil/bprint.h"
@@ -1200,11 +1201,13 @@ static int parse_playlist(AVFormatContext *s, const char *url, VariantStream *vs
ptr = av_stristr(line, "URI=\"");
if (ptr) {
ptr += strlen("URI=\"");
end = av_stristr(ptr, ",");
end = strchr(ptr, '"');
if (end) {
av_strlcpy(vs->key_uri, ptr, end - ptr);
av_strlcpy(vs->key_uri, ptr,
FFMIN(end - ptr + 1, sizeof(vs->key_uri)));
} else {
av_strlcpy(vs->key_uri, ptr, sizeof(vs->key_uri));
ret = AVERROR_INVALIDDATA;
goto fail;
}
}
@@ -1213,7 +1216,7 @@ static int parse_playlist(AVFormatContext *s, const char *url, VariantStream *vs
ptr += strlen("IV=0x");
end = av_stristr(ptr, ",");
if (end) {
av_strlcpy(vs->iv_string, ptr, end - ptr);
av_strlcpy(vs->iv_string, ptr, FFMIN(end - ptr + 1, sizeof(vs->iv_string)));
} else {
av_strlcpy(vs->iv_string, ptr, sizeof(vs->iv_string));
}