Full Disclosure mailing list archives

Improper validation in libavutil/avstring.c allows a NULL pointer
dereference when processing certain strings in HLS contexts. UBSan reports
"applying zero offset to null pointer." Triggers denial of service (DoS)
when FFmpeg processes malicious playlists or malformed URLs. (FFmpeg 7.0 –
8.0)

*Impact:*

   -

   Consistently crashes the process (DoS).
   -

   Exploitation beyond denial of service is unlikely on modern OSes.


*Proof of Concept:*#EXTM3U
#EXTINF:10,
http://example.com/dummy.ts

./ffmpeg -i malicious.m3u8 -c copy out.mp4


*Output:*libavutil/avstring.c:455:15: runtime error: applying zero offset
to null pointer
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• FFmpeg 7.0+ NULL Pointer Dereference in FFmpeg String Handling (avstring.c) Ron E (Sep 08)