This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.0 in repository ffmpeg.
commit 9a1394353e1b86d3186aea05fb8d2ef563f9f799 Author: haoyuLiu <[email protected]> AuthorDate: Wed Jun 10 03:40:50 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 14 04:59:13 2026 +0200 avformat/http: reject request-line tokens not terminated by whitespace Fixes out of array access Found-by: Cloud-LHY (@Clouditera-lhy) / VulnForge Security Research Team Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit dd9083cb89c7f015d7fefe037a12e9e53d621cd9) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/http.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/http.c b/libavformat/http.c index 4c75a5c89f..9551cf0a8f 100644 --- a/libavformat/http.c +++ b/libavformat/http.c @@ -1158,6 +1158,8 @@ static int process_line(URLContext *h, char *line, int line_count, int *parsed_h method = p; while (*p && !av_isspace(*p)) p++; + if (!av_isspace(*p)) + return ff_http_averror(400, AVERROR(EIO)); *(p++) = '\0'; av_log(h, AV_LOG_TRACE, "Received method: %s\n", method); if (s->method) { @@ -1184,6 +1186,8 @@ static int process_line(URLContext *h, char *line, int line_count, int *parsed_h resource = p; while (*p && !av_isspace(*p)) p++; + if (!av_isspace(*p)) + return ff_http_averror(400, AVERROR(EIO)); *(p++) = '\0'; av_log(h, AV_LOG_TRACE, "Requested resource: %s\n", resource); if (!(s->resource = av_strdup(resource))) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
