PR #24517 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24517 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24517.patch
do_encrypt() copied 16 bytes from each option string without checking Fixes: heap buffer overflow (read) Fixes: XoynvIRQMj1M Found-by: Zheng Yu @ Depthfirst >From db242dd9919d48bac3ae253b4bdb64ff4768e94e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 15 Sep 2026 06:09:01 +0200 Subject: [PATCH] avformat/hlsenc: reject hls_enc_key and hls_enc_iv values shorter than 16 bytes do_encrypt() copied 16 bytes from each option string without checking Fixes: heap buffer overflow (read) Fixes: XoynvIRQMj1M Found-by: Zheng Yu @ Depthfirst --- libavformat/hlsenc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/hlsenc.c b/libavformat/hlsenc.c index 4726a4a708..519b0c99b8 100644 --- a/libavformat/hlsenc.c +++ b/libavformat/hlsenc.c @@ -670,6 +670,9 @@ static int do_encrypt(AVFormatContext *s, VariantStream *vs) if (!hls->iv) { AV_WB64(iv + 8, vs->sequence); + } else if (strlen(hls->iv) < sizeof(iv)) { + av_log(hls, AV_LOG_ERROR, "hls_enc_iv is shorter than %zu bytes\n", sizeof(iv)); + return AVERROR(EINVAL); } else { memcpy(iv, hls->iv, sizeof(iv)); } @@ -694,6 +697,9 @@ static int do_encrypt(AVFormatContext *s, VariantStream *vs) av_log(s, AV_LOG_ERROR, "Cannot generate a strong random key\n"); return ret; } + } else if (strlen(hls->key) < sizeof(key)) { + av_log(hls, AV_LOG_ERROR, "hls_enc_key is shorter than %zu bytes\n", sizeof(key)); + return AVERROR(EINVAL); } else { memcpy(key, hls->key, sizeof(key)); } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
