From 976490dcc3dbe0684851c30eff88a85d4d386d1a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 23 Jun 2026 04:15:24 +0200 Subject: [PATCH] avformat/hls_sample_encryption: Validate ADTS frame length against packet Fixes: out of array access Fixes: playlist.m3u8 / make_poc.py Fixes: rJ50u41V7ctk Fixes: ff958b3846 (libavformat/hls: add support for decryption of HLS media segments encrypted using SAMPLE-AES encryption method) Found-by: Clouditera Security Research Team Signed-off-by: Michael Niedermayer --- libavformat/hls_sample_encryption.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavformat/hls_sample_encryption.c b/libavformat/hls_sample_encryption.c index 26de098dda..c41de3143b 100644 --- a/libavformat/hls_sample_encryption.c +++ b/libavformat/hls_sample_encryption.c @@ -374,6 +374,13 @@ static int decrypt_audio_frame(enum AVCodecID codec_id, HLSCryptoContext *crypto ret = get_next_sync_frame(codec_id, &ctx, &frame); if (ret < 0) return ret; + if (frame.length < frame.header_length || + frame.length > ctx.buf_end - frame.data) { + av_log(NULL, AV_LOG_ERROR, + "Sample-AES: declared frame length %d exceeds packet data\n", + frame.length); + return AVERROR_INVALIDDATA; + } if (frame.length - frame.header_length > 31) { ret = decrypt_sync_frame(codec_id, crypto_ctx, &frame); if (ret < 0)