Commit 6d898e0c17 for ffmpeg

commit 6d898e0c1726afa9cb47e0835202e69d36c2d059
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Nov 11 19:36:54 2026 +0100

    avformat/http: reject CR and LF in the hostname

    Fixes: CRLF injection
    Fixes: eiIHGT2jJznc
    Fixes: proxy_host_crlf_poc.py
    CRLF injection Replicated through UnModified FFmpeg with a local TCP listener

    Found during triage of the security report iUFdqPjbigVZ (ZDI-CAN-35984)

diff --git a/libavformat/http.c b/libavformat/http.c
index 3551680d98..2a4481da59 100644
--- a/libavformat/http.c
+++ b/libavformat/http.c
@@ -267,6 +267,8 @@ static int http_open_cnx_internal(URLContext *h, AVDictionary **options)
     av_url_split(proto, sizeof(proto), auth, sizeof(auth),
                  hostname, sizeof(hostname), &port,
                  path1, sizeof(path1), s->location);
+    if (strpbrk(hostname, "\r\n"))
+        return AVERROR(EINVAL);

     av_freep(&s->host);
     s->host = av_strdup(hostname);