Builder ffmpeg-solaris10-sparc Build #14006

Results:

Failed shell_2 shell_3 shell_4 shell_5

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-ffmpeg-solaris10-sparc' triggered this build

Steps and Logfiles:

1. git update ( 11 secs )
   1. stdio
2. shell 'gsed -i ...' ( 0 secs )
   1. stdio
3. shell_1 'gsed -i ...' ( 0 secs )
   1. stdio
4. shell_2 'gsed -i ...' failed ( 0 secs )
   1. stdio
5. shell_3 './configure --samples="../../../ffmpeg/fate-suite" ...' failed ( 7 secs )
   1. stdio
   2. config.log
6. shell_4 'gmake fate-rsync' failed ( 0 secs )
   1. stdio
7. shell_5 '../../../ffmpeg/fate.sh ../../../ffmpeg/fate_config.sh' failed ( 0 secs )
   1. stdio
   2. configure.log
   3. compile.log
   4. test.log

Build Properties:

Forced Build Properties:

Responsible Users:

1. Omkhar Arasaratnam

   omkharohnoyoudont@linkedin.com

Timing:

All Changes:

:

1. Change #276475

   Category	ffmpeg
   Changed by	Omkhar Arasaratnam <omkharohnoyoudont@linkedin.com>
   Changed at	Wed 29 Jul 2026 22:37:16
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	83c692282631e6d035fa52d2e2c5118b1d2a27d7

   Comments

   avformat/tls_openssl: bind peer identity for numeric-IP verify
   tls_open() installed a peer-identity target only when the URL host was
   non-numeric. For a numeric-IP target the whole block was skipped, so
   with verify=1 OpenSSL validated the chain to a trusted CA but bound no
   identity, and any publicly-trusted certificate for any name was accepted
   (e.g. tls://203.0.113.10?verify=1).
   
   Run the identity block for every non-listening connection. Classify
   s->host with the same getaddrinfo(AI_NUMERICHOST) rule tls.c uses. A
   numeric host is pinned to the certificate's iPAddress SAN by handing
   OpenSSL the parsed binary address via X509_VERIFY_PARAM_set1_ip();
   everything else, including a verifyhost=<name> override, binds by name
   via SSL_set1_host(). Passing the binary address rather than re-probing
   the ASCII form pins legacy numeric spellings such as 2130706433 as IPs
   instead of letting them fall back to hostname matching. SNI is still
   suppressed for numeric transport hosts (RFC 6066 sec. 3) via
   s->numerichost.
   
   The identity target is installed unconditionally for non-listening
   connections; whether the certificate is actually verified stays
   controlled separately by SSL_CTX_set_verify() under s->verify, so
   disabling verification keeps the prior behaviour. Sets AVERROR_EXTERNAL
   with an explicit log line on failure.
   
   dtls_open() sets s->is_dtls and then calls tls_open(), so DTLS client
   connections run through the same identity block and are covered here.
   
   Found-by: Claude (Anthropic). Human-verified and reported by
   Omkhar Arasaratnam <omkhar@linkedin.com>.
   Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>

   Changed files

   • libavformat/tls_openssl.c