Commit 957684f809 for ffmpeg

commit 957684f809eae92f5c0ff0fe57f967cbd357ab23
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Nov 11 19:38:10 2026 +0100

    avformat/httpauth: do not put CR or LF into the Digest header

    Fixes: CRLF injection
    Fixes: avx3Qkpk8ANg
    Fixes: digest_username_crlf_poc.py
    Fixes: proxy_digest_uri_crlf_poc.py
    CRLF injection Replicated through UnModified FFmpeg with a local TCP listener

    Found during triage of the security report iUFdqPjbigVZ (ZDI-CAN-35984)

diff --git a/libavformat/httpauth.c b/libavformat/httpauth.c
index 276054a98e..e9aeb95ec8 100644
--- a/libavformat/httpauth.c
+++ b/libavformat/httpauth.c
@@ -292,7 +292,8 @@ char *ff_http_auth_create_response(HTTPAuthState *state, const char *auth,
         if (!username)
             return NULL;

-        if ((password = strchr(username, ':'))) {
+        if ((password = strchr(username, ':')) &&
+            !strpbrk(username, "\r\n") && !strpbrk(path, "\r\n")) {
             *password++ = 0;
             authstr = make_digest_auth(state, username, password, path, method);
         }