This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 488061b9cb2e29a22b64962b64e2424b732d10a8 Author: Niklas Haas <[email protected]> AuthorDate: Mon Jun 29 16:58:18 2026 +0200 Commit: Kacper Michajłow <[email protected]> CommitDate: Mon Jul 27 17:05:20 2026 +0000 avformat/libcurl: guard against overflow from over-reading data In theory a client could be coaxed by a malicious server to seek to a large 64-bit offset, which would then trigger an overflow of the position. Better safe than sorry and just error out with EIO in such cases. Sponsored-by: nxtedition AB Signed-off-by: Niklas Haas <[email protected]> --- libavformat/libcurl.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavformat/libcurl.c b/libavformat/libcurl.c index 2d625915ca..6ea66c118c 100644 --- a/libavformat/libcurl.c +++ b/libavformat/libcurl.c @@ -434,6 +434,13 @@ static void on_done(CurlContext *c, CURLcode code) aborted = c->aborted; received = c->request_received; /* Advance past delivered bytes so a retry or seek resumes at the right offset. */ + if (received > INT64_MAX - c->request_start) { + if (!c->error) + c->error = AVERROR(EIO); + received = 0; + aborted = 1; + pthread_cond_broadcast(&c->cond); + } c->request_start += received; c->request_received = 0; pthread_mutex_unlock(&c->mutex); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
