RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/hls: update current segment reference before use 

It may be invalidated by the time it is used.

Fixes use after free when accessing current segment.

Fixes: #10825
Signed-off-by: J. Dekker <jdek@itanimul.li>
This commit is contained in:
Kacper Michajłow 2024-03-17 03:36:16 +01:00 committed by J. Dekker
parent 62d7106c36
commit b2b23f353a
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libavformat/hls.c
View File

@ -2099,6 +2099,7 @@ static int hls_read_header(AVFormatContext *s)
* If encryption scheme is SAMPLE-AES and audio setup information is present in external audio track,
* use that information to find the media format, otherwise probe input data
*/
seg = current_segment(pls);
if (seg && seg->key_type == KEY_SAMPLE_AES && pls->is_id3_timestamped &&
pls->audio_setup_info.codec_id != AV_CODEC_ID_NONE) {
av_assert1(pls->audio_setup_info.codec_id == AV_CODEC_ID_AAC ||
@ -2127,6 +2128,7 @@ static int hls_read_header(AVFormatContext *s)
av_free(url);
}
seg = current_segment(pls);
if (seg && seg->key_type == KEY_SAMPLE_AES) {
if (strstr(in_fmt->name, "mov")) {
char key[33];
@ -2173,6 +2175,7 @@ static int hls_read_header(AVFormatContext *s)
* on us if they want to.
*/
if (pls->is_id3_timestamped || (pls->n_renditions > 0 && pls->renditions[0]->type == AVMEDIA_TYPE_AUDIO)) {
seg = current_segment(pls);
if (seg && seg->key_type == KEY_SAMPLE_AES && pls->audio_setup_info.setup_data_length > 0 &&
pls->ctx->nb_streams == 1)
ret = ff_hls_senc_parse_audio_setup_info(pls->ctx->streams[0], &pls->audio_setup_info);