@@ -165,6 +165,12 @@ static int load_identity(URLContext *h, SecIdentityRef *identity, CFArrayRef *ce
if ((ret = import_pem(h, c->tls_shared.key_file, &keyArray)) < 0)
goto end;
+ if (CFGetTypeID(CFArrayGetValueAtIndex(*certArray, 0)) != SecCertificateGetTypeID() ||
+ CFGetTypeID(CFArrayGetValueAtIndex(keyArray, 0)) != SecKeyGetTypeID()) {
+ ret = AVERROR_INVALIDDATA;
+ goto end;
+ }
+
if (!(*identity = SecIdentityCreate(kCFAllocatorDefault,
(SecCertificateRef)CFArrayGetValueAtIndex(*certArray, 0),
(SecKeyRef)CFArrayGetValueAtIndex(keyArray, 0)))) {