[FFmpeg-devel] [PR] avformat/hls: Check for integer overflow with #EXTINF: (PR #21646)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21646 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21646
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21646.patch

Found-by: 이동준 <ldj6192@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


From e60d4d38a26bc4e5845ecf82919ba8fa64efba93 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 4 Feb 2026 16:43:39 +0100
Subject: [PATCH] avformat/hls: Check for integer overflow with #EXTINF:
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Found-by: 이동준 <ldj6192@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/hls.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index 58650f717c..28c883097a 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -970,8 +970,13 @@ static int parse_playlist(HLSContext *c, const char *url,
             if (pls)
                 pls->finished = 1;
         } else if (av_strstart(line, "#EXTINF:", &ptr)) {
+            double d = atof(ptr) * AV_TIME_BASE;
+            if (d < 0 || d > INT64_MAX || isnan(d)) {
+                av_log(c->ctx, AV_LOG_WARNING, "EXTINF %f unsupported\n", d / AV_TIME_BASE);
+                d = 0;
+            }
+            duration = d;
             is_segment = 1;
-            duration   = atof(ptr) * AV_TIME_BASE;
         } else if (av_strstart(line, "#EXT-X-BYTERANGE:", &ptr)) {
             seg_size = strtoll(ptr, NULL, 10);
             ptr = strchr(ptr, '@');
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org