Commit 1bdc17e2c8 for ffmpeg

commit 1bdc17e2c8f9528c3db2140cb45002a3663d938f
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Nov 11 19:25:26 2026 +0100

    avformat/http: reject control characters and spaces in the CONNECT target

    Fixes: CRLF injection
    Fixes: ZDI-CAN-35984
    Fixes: iUFdqPjbigVZ
    CRLF injection Replicated through UnModified FFmpeg with a local TCP listener

    Found-by: Yves Bieri (@yves_bieri) of Xint (@xint_official) working with TrendAI Zero Day Initiative

diff --git a/libavformat/http.c b/libavformat/http.c
index 546b591d0c..3551680d98 100644
--- a/libavformat/http.c
+++ b/libavformat/http.c
@@ -2562,6 +2562,9 @@ static int http_proxy_open(URLContext *h, const char *uri, int flags)
     path = pathbuf;
     if (*path == '/')
         path++;
+    for (const char *p = path; *p; p++)
+        if ((uint8_t)*p <= ' ' || *p == 0x7f)
+            return AVERROR(EINVAL);

     ff_url_join(lower_url, sizeof(lower_url), "tcp", NULL, hostname, port,
                 NULL);