This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/6.1 in repository ffmpeg.
commit 80b3a04f5d3df5bd8feb09dfaa30f53eb8972834 Author: Michael Niedermayer <[email protected]> AuthorDate: Wed May 20 01:24:54 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 14 19:38:52 2026 +0200 avformat/hls: Check TIME-OFFSET value Fixes: UB with out of range values Fixes: poc_overflow.m3u8 Found-by: jiale yao Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 59094859a8affb9f8715a003d9fa3d0c13041d56) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/hls.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index 5e166978e0..97052b7354 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -953,9 +953,14 @@ static int parse_playlist(HLSContext *c, const char *url, goto fail; } if (av_strstart(ptr, "TIME-OFFSET=", &time_offset_value)) { - float offset = strtof(time_offset_value, NULL); - pls->start_time_offset = offset * AV_TIME_BASE; - pls->time_offset_flag = 1; + double offset = strtod(time_offset_value, NULL) * AV_TIME_BASE; + if (offset >= -0x1p63 && offset < 0x1p63) { + pls->start_time_offset = offset; + pls->time_offset_flag = 1; + } else { + av_log(c->ctx, AV_LOG_WARNING, "TIME-OFFSET value is" + "invalid, it will be ignored"); + } } else { av_log(c->ctx, AV_LOG_WARNING, "#EXT-X-START value is" "invalid, it will be ignored"); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
