PR #25685 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25685 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25685.patch
Fixes: local file disclosure Fixes: 5XX7X8ZhsNmw Fixes: ANT-2026-QUKQXXX6 Local file disclosure Replicated through UnModified FFmpeg with the ffmpeg command line tool Found-by: Anthropic (ANT-2026-QUKQXXX6) via https://red.anthropic.com/oss-scanner/ Reported-by: Thomas Guillem (VideoLAN) >From 6caa1498bbbd91b51d34b30a5c57cf5b74087c16 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 29 Oct 2026 18:33:09 +0100 Subject: [PATCH] avformat/hlsproto: restrict the protocols a playlist may reference Fixes: local file disclosure Fixes: 5XX7X8ZhsNmw Fixes: ANT-2026-QUKQXXX6 Local file disclosure Replicated through UnModified FFmpeg with the ffmpeg command line tool Found-by: Anthropic (ANT-2026-QUKQXXX6) via https://red.anthropic.com/oss-scanner/ Reported-by: Thomas Guillem (VideoLAN) --- libavformat/hlsproto.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/libavformat/hlsproto.c b/libavformat/hlsproto.c index f0e2230a709..a69b01e2ed4 100644 --- a/libavformat/hlsproto.c +++ b/libavformat/hlsproto.c @@ -223,6 +223,18 @@ static int hls_open(URLContext *h, const char *uri, int flags) "To use the demuxer, simply use %s as url.\n", s->playlisturl); + if (!h->protocol_whitelist) { + const char *playlist_proto = avio_find_protocol_name(s->playlisturl); + h->protocol_whitelist = + av_strdup(playlist_proto && !strcmp(playlist_proto, "file") ? + "file,crypto,data" : + "http,https,tls,rtp,tcp,udp,crypto,httpproxy,data"); + if (!h->protocol_whitelist) { + ret = AVERROR(ENOMEM); + goto fail; + } + } + if ((ret = parse_playlist(h, s->playlisturl)) < 0) goto fail; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
