Steven Liu
01044d0453
avformat/hls: Enforce protocol checks when opening child playlists
...
Fix: vulnerability:019f3b84-903b-75fb-a8de-fad1c2d7e99c
The parse_playlist() path for opening a new child playlist (in == NULL)
directly called c->ctx->io_open(), bypassing the protocol whitelist and
file-extension checks that open_url() enforces. This allowed child URLs
from a master playlist to use protocols other than file/http/data or to
have disallowed extensions.
Route the !in branch through open_url() so that all child playlists are
subject to the same security policy as segment URLs.
Fixes a security bypass in HLS master playlist parsing.
Found-by: depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org >
(cherry picked from commit 23602df9cd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2026-08-02 02:47:29 +02:00
..
2026-07-21 22:59:57 +02:00
2026-05-31 00:39:51 +00:00
2026-06-23 19:15:57 +02:00
2026-06-24 23:31:53 +02:00
2026-06-24 23:31:54 +02:00
2026-06-24 23:31:53 +02:00
2026-06-24 23:31:53 +02:00
2026-06-23 19:15:57 +02:00
2026-06-23 19:15:57 +02:00
2026-06-23 17:15:02 +02:00
2026-06-23 19:15:57 +02:00
2026-06-23 19:15:57 +02:00
2026-07-23 13:58:00 -03:00
2026-07-21 22:59:59 +02:00
2026-06-23 19:15:57 +02:00
2026-06-15 02:22:05 +00:00
2026-06-23 00:04:42 +00:00
2026-06-23 19:15:57 +02:00
2026-06-23 19:15:57 +02:00
2026-06-12 00:46:32 +00:00
2026-06-23 19:15:57 +02:00
2026-06-23 19:15:57 +02:00
2026-06-23 19:15:57 +02:00
2026-06-05 01:14:02 +00:00
2026-07-21 22:59:54 +02:00
2026-08-02 02:47:29 +02:00
2026-08-02 02:47:28 +02:00
2026-06-23 00:04:42 +00:00
2026-06-23 00:04:42 +00:00
2026-06-25 15:50:43 +00:00
2026-07-29 21:10:58 +00:00
2026-07-21 22:59:54 +02:00
2026-07-21 22:59:52 +02:00
2026-06-23 19:15:57 +02:00
2026-06-23 19:15:57 +02:00
2026-06-23 19:13:06 +02:00
2026-06-16 09:18:23 -03:00
2026-06-16 09:18:24 -03:00
2026-07-23 13:58:00 -03:00
2026-07-23 13:58:00 -03:00
2026-06-23 19:15:57 +02:00
2026-07-21 22:59:57 +02:00
2026-05-30 17:37:28 +00:00
2026-06-23 19:15:57 +02:00
2026-06-17 11:11:18 +00:00
2026-06-15 15:13:53 +00:00
2026-06-01 09:53:54 -03:00
2026-07-21 23:00:00 +02:00
2026-06-23 19:15:57 +02:00
2026-07-23 13:58:00 -03:00
2026-06-23 19:15:57 +02:00
2026-05-31 00:39:51 +00:00
2026-06-23 19:15:57 +02:00
2026-07-21 22:59:51 +02:00
2026-06-15 00:25:34 +00:00
2026-05-31 03:43:29 +00:00
2026-06-23 19:15:57 +02:00
2026-05-29 18:23:06 +00:00
2026-06-23 19:15:57 +02:00
2026-06-23 19:15:57 +02:00
2026-06-23 17:15:02 +02:00
2026-06-23 17:15:02 +02:00
2026-06-23 19:15:57 +02:00
2026-06-23 19:15:57 +02:00
2026-06-04 17:48:12 +02:00
2026-06-23 19:13:06 +02:00
2026-06-11 14:06:20 +00:00
2026-06-11 14:06:20 +00:00
2026-06-03 23:36:13 +00:00
2026-07-21 22:59:51 +02:00
2026-06-14 15:32:48 +00:00
2026-06-13 21:31:18 +00:00
2026-06-23 19:15:57 +02:00
2026-07-21 22:59:55 +02:00
2026-07-21 22:59:51 +02:00
2026-06-23 19:15:57 +02:00
2026-06-05 00:43:20 +02:00
2026-07-21 23:00:00 +02:00
2026-06-25 15:34:04 +03:00
2026-06-23 17:15:02 +02:00
2026-06-23 19:15:57 +02:00
2026-07-21 22:59:59 +02:00
2026-07-21 22:59:57 +02:00
2026-06-23 19:15:57 +02:00
2026-06-26 02:43:34 +02:00
2026-07-21 22:59:52 +02:00
2026-07-07 22:27:00 +08:00
2026-06-24 23:31:53 +02:00