PR #23397 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23397 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23397.patch Fixes: integer overflow Found-by: Kery (Qi Kery <qikeyu2001@outlook.com>) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> From 59fc7c25914ae7e5793cbf73d8e7f8174cf9d20e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <michael@niedermayer.cc> Date: Sat, 6 Jun 2026 21:02:12 +0200 Subject: [PATCH] avformat/hlsenc: reject out-of-range EXT-X-PROGRAM-DATE-TIME Fixes: integer overflow Found-by: Kery (Qi Kery <qikeyu2001@outlook.com>) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/hlsenc.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/libavformat/hlsenc.c b/libavformat/hlsenc.c index 6fd99e811b..52f4f31433 100644 --- a/libavformat/hlsenc.c +++ b/libavformat/hlsenc.c @@ -1230,6 +1230,13 @@ static int parse_playlist(AVFormatContext *s, const char *url, VariantStream *vs goto fail; } + // Basic RFC 3339 field bounds + if (y < 0 || M < 1 || d < 1|| h < 0 || m < 0 || sec < 0 || ms < 0 || + y > 9999 || M > 12 || d > 31 || h > 23 || m > 59 || sec > 60 || ms >= 1000 + ) { + ret = AVERROR_INVALIDDATA; + goto fail; + } program_date_time.tm_year = y - 1900; program_date_time.tm_mon = M - 1; program_date_time.tm_mday = d; @@ -1238,7 +1245,14 @@ static int parse_playlist(AVFormatContext *s, const char *url, VariantStream *vs program_date_time.tm_sec = sec; program_date_time.tm_isdst = -1; - discont_program_date_time = mktime(&program_date_time); + errno = 0; + time_t t = mktime(&program_date_time); + if (t == (time_t)-1 && errno == EOVERFLOW) { + ret = AVERROR_INVALIDDATA; + goto fail; + } + discont_program_date_time = t; + discont_program_date_time += (double)(ms / 1000); } else if (av_strstart(line, "#", NULL)) { continue; -- 2.52.0