tls_open() installed a peer-identity target only when the URL host was
non-numeric. For a numeric-IP target the whole block was skipped, so
with verify=1 OpenSSL validated the chain to a trusted CA but bound no
identity, and any publicly-trusted certificate for any name was accepted
(e.g. tls://203.0.113.10?verify=1).
Run the identity block for every non-listening connection. Classify
s->host with the same getaddrinfo(AI_NUMERICHOST) rule tls.c uses. A
numeric host is pinned to the certificate's iPAddress SAN by handing
OpenSSL the parsed binary address via X509_VERIFY_PARAM_set1_ip();
everything else, including a verifyhost=<name> override, binds by name
via SSL_set1_host(). Passing the binary address rather than re-probing
the ASCII form pins legacy numeric spellings such as 2130706433 as IPs
instead of letting them fall back to hostname matching. SNI is still
suppressed for numeric transport hosts (RFC 6066 sec. 3) via
s->numerichost.
The identity target is installed unconditionally for non-listening
connections; whether the certificate is actually verified stays
controlled separately by SSL_CTX_set_verify() under s->verify, so
disabling verification keeps the prior behaviour. Sets AVERROR_EXTERNAL
with an explicit log line on failure.
dtls_open() sets s->is_dtls and then calls tls_open(), so DTLS client
connections run through the same identity block and are covered here.
Found-by: Claude (Anthropic). Human-verified and reported by
Omkhar Arasaratnam <omkhar@linkedin.com>.
Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>
(cherry picked from commit 83c6922826)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fix: vulnerability:019f3b84-903b-75fb-a8de-fad1c2d7e99c
The parse_playlist() path for opening a new child playlist (in == NULL)
directly called c->ctx->io_open(), bypassing the protocol whitelist and
file-extension checks that open_url() enforces. This allowed child URLs
from a master playlist to use protocols other than file/http/data or to
have disallowed extensions.
Route the !in branch through open_url() so that all child playlists are
subject to the same security policy as segment URLs.
Fixes a security bypass in HLS master playlist parsing.
Found-by: depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 23602df9cd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fix: vulnerability:019f3b84-903b-75fb-a8de-fe6f84d6bc32
When parsing IV=0x... followed by a comma, end - ptr was passed directly
to av_strlcpy() as the destination size. Since iv_string is only 33 bytes
(KEYSIZE*2 + 1), a long IV token could overflow into adjacent heap data.
Use FFMIN(end - ptr + 1, sizeof(buf)) to cap the copy size to the actual
buffer size. Apply the same fix to key_uri parsing for consistency.
Fixes a heap buffer overflow in append_list mode when reading an existing
playlist with a crafted IV or URI token length.
Found-by: depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 275e217b10)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
fix: vulnerability:019f3b84-90fb-737a-ae7a-b3e0219266fc
extract_segment_number() used strrchr(filename, '.') and immediately did
dot - 1 without checking for NULL. A segment URI with no extension would
cause undefined behavior (NULL pointer arithmetic) when resuming an
append_list playlist with subtitle variants.
Add a NULL check and return -1 early when no dot is found.
Fixes a crash/UB in HLS muxer resume path.
Found-by: depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 601d9ee881)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
tls_mbedtls verifies the peer certificate manually via
mbedtls_ssl_get_verify_result() (it uses MBEDTLS_SSL_VERIFY_OPTIONAL), but
only in tls_open(). On the external-socket path (external_sock=1) tls_open()
skips the handshake; it then runs later through the url_handshake hook,
tls_handshake(), which never checks the verification result, so with verify=1
an untrusted peer certificate would be accepted.
The only in-tree user of this path is the WHIP muxer, which sets verify=0
(WebRTC binds the peer via the SDP a=fingerprint, not a CA), so this is not
reachable today. This change is defence-in-depth: it makes tls_handshake()
honor verify symmetrically with the existing tls_open() check.
Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>
(cherry picked from commit b96701098f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This variant is easy backportable but is concatdec specific
Fixes: self_ref.ffconcat
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Rediscovered-by: Anxious Koisi
Fixes: RWHkT0ASFMNI
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 58d39e99e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: playlist.m3u8 / make_poc.py
Fixes: rJ50u41V7ctk
Fixes: ff958b3846 (libavformat/hls: add support for decryption of HLS media segments encrypted using SAMPLE-AES encryption method)
Found-by: Clouditera Security Research Team <haoyuliu@clouditera.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 976490dcc3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes use of uninitialized value and dumping it into AVERAGE-BANDWIDTH
in playlist. Note this will be correctly set when we are at final
segment, otherwise it's optional.
Fixes: fate-hls-seek test on MSAN build
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit dc953a19e6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
fix ticket: 8636
video_keyframe_size and video_keyframe_pos tracked the end of the
previous P/B frame. In the case of I-frame only videos, this would
result in byteoffsets always being 0@0 in the case of fmp4. For
mpegts, the size would be correct but the pos still always be @0.
Since size and pos already correctly track the start of a segment,
we can re-use them even in I-frame only mode.
(cherry picked from commit ea3d417d90)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Based on a patch by Michael Niedermayer
Fixes: unbounded allocation
Fixes: poc_output_mix_config_dos.iamf
Fixes: 387qWpjUgeKH
Found-by: Duong Tran Thai (CyStack)
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d2476bfd2b)
mov_flush_fragment() calls ffio_reset_dyn_buf() on mov->mdat_buf when
writing the initial moov. That buffer is allocated lazily on the first
packet, so it is still NULL when the trailer is written before anything
was muxed, and ffio_reset_dyn_buf() dereferences it.
627da1111c replaced ffio_free_dyn_buf(), which tolerates NULL, with
ffio_reset_dyn_buf(), which does not, turning this case into a crash.
This affects every fragmented mode that defers the initial moov to the
first flush.
Skip the block entirely when the buffer was never opened. Nothing
references the empty mdat it would otherwise write, as no samples were
muxed.
Reproduced with:
ffmpeg -f lavfi -i color=s=64x64 -frames:v 0 -movflags +frag_keyframe out.mp4
Fixes: 627da1111c ("libavformat/movenc: Uses dynamic buffers for fragmented chunks")
Signed-off-by: Ackanir <git.ackanir@gmail.com>
(cherry picked from commit 9f35e220ff)
Fixes: out of array read
Fixes: yBSax492UIB9
Fixes: 482d98f69b (spdifenc: IEC 61937 encapsulation of DTS-HD for HDMI)
Found-by: Pavel Kohout (Aisle Research)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6f80e27654)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 385ac2fadc)
Signed-off-by: Adam Shaver <ashaver@nvidia.com>
The check on variable subblock durations had an inverted comparison, rejecting valid multi-subblock parameters and failing to catch subblock durations exceeding the remaining time.
(cherry picked from commit 1635b49b80402c8cec39eefb12f35e2ee7c13606)
When ffmpeg whip client takes up dtls_active role when using gnutls,
it tries to connect to the server over udp and intermittently crashes.
This is because s->host is NULL, and ffmpeg is in ice controlling mode.
The gnutls api - gnutls_server_name_set() crashes if the hostname is NULL.
This commit assigns valid value to s->host in such scenarios.
Signed-off-by: Aditya Banavi <adityabanavi@gmail.com>
(cherry picked from commit 28b92b9b2e)
The upstream fix calls ff_tls_parse_host(), which was introduced after this
branch point by commit df3511db5bdf; its host-parsing is inlined here rather
than backporting that refactor.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Reported by Franciszek Kalinowski (isec.pl / striga.ai) and Bartosz Smigielski.
(cherry picked from commit 99e1ecca36)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit 5b98cea4 added a size < 2 guard to sctp_write() to prevent
out-of-bounds access when max_streams is enabled, but the identical
pattern in sctp_read() was not addressed.
When max_streams is non-zero, sctp_read() passes (buf + 2, size - 2)
to ff_sctp_recvmsg(). If size < 2, size - 2 wraps to a large value
on the implicit cast to size_t in the callee.
Add the same guard.
Signed-off-by: bird <6666242+bird@users.noreply.github.com>
(cherry picked from commit 5c3602abaa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Supporting PCM streams requires API changes present in newer releases that
can't be backported, so don't create invalid files.
Signed-off-by: James Almer <jamrial@gmail.com>
Reported by Franciszek Kalinowski (isec.pl / striga.ai) and Bartosz Smigielski.
(cherry picked from commit 6049b4d7bc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes out of array access
Found-by: Cloud-LHY (@Clouditera-lhy) / VulnForge Security Research Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd9083cb89)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
ispe width/height are read as uint32 but stored in int HEIFItem fields;
values above INT_MAX became negative, and read_image_grid() summing such
widths into coded_width overflowed int:
libavformat/mov.c:10404:33: runtime error: signed integer overflow: -2147483647 + -2147483647 cannot be represented in type 'int'
Also accumulate the grid tile dimensions and running offsets in 64bit
and validate the totals, as up to 256 tile columns of individually
valid widths can still overflow int.
Found-by: 51511
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2cc7b87bdb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: ada-2-poc.dhav
Found-by: Claude and Ada Logics. This issue was found by Anthropic from using agents to study security of open source projects, and I am from Ada Logics helping validate the found issues and report to maintainers.
(cherry picked from commit 50e65074f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: ada-3-poc.mpd
Found-by: Claude and Ada Logics. This issue was found by Anthropic from using agents to study security of open source projects, and I am from Ada Logics helping validate the found issues and report to maintainers.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b99c6fc8c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
After the fix the reproducer finishes in 43 ms instead of OOM-ing at the
2 GB limit. Legitimate .mkv/.webm fate samples still parse cleanly.
Fixes: 471604245/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6662979358883840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c7e0bac050)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Based on flvdec.c
Fixes: out of array access
Found-by: Xueqing
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 92804c9e25)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
ftp_connect() interpolates the URL path into SIZE/RETR/STOR/CWD/DELE/RMD/RNFR
commands without checking for CR/LF, although it already rejects CR/LF in the
user and password fields. Reject CR/LF in s->path the same way.
Reported and reviewed by Franciszek Kalinowski (isec.pl / striga.ai) and Bartosz Śmigielski.
(cherry picked from commit 640f32b1b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
