dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-09 01:21:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

avformat/hls_sample_encryption: Validate ADTS frame length against packet

Browse Source 
Fixes: out of array access
Fixes: playlist.m3u8 / make_poc.py
Fixes: rJ50u41V7ctk
Fixes: ff958b3846 (libavformat/hls: add support for decryption of HLS media segments encrypted using SAMPLE-AES encryption method)
Found-by: Clouditera Security Research Team <haoyuliu@clouditera.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-06-23 04:15:24 +02:00
committed by michaelni
parent c74f279559
commit 976490dcc3
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libavformat/hls_sample_encryption.c
View File

@@ -374,6 +374,13 @@ static int decrypt_audio_frame(enum AVCodecID codec_id, HLSCryptoContext *crypto
ret = get_next_sync_frame(codec_id, &ctx, &frame);
if (ret < 0)
return ret;
if (frame.length < frame.header_length ||
frame.length > ctx.buf_end - frame.data) {
av_log(NULL, AV_LOG_ERROR,
"Sample-AES: declared frame length %d exceeds packet data\n",
frame.length);
return AVERROR_INVALIDDATA;
}
if (frame.length - frame.header_length > 31) {
ret = decrypt_sync_frame(codec_id, crypto_ctx, &frame);
if (ret < 0)