[Ffmpeg-devel] [C API] Add suport for ifstreams

François Revol revol
Tue Sep 5 08:48:19 CEST 2006


> On Mon, Sep 04, 2006 at 11:15:03PM +0100, M?ns Rullg?rd wrote:
> > "Fran?ois Revol" <revol at free.fr> writes:
> > 
> > > Another option is to add a custom protocol like ifstream: which 
> > > reads 
> > > the sting as the numeric value of a pointer, like 
> > > ifstream:0xdeadbeef.
> > 
> > I can see this leading to some interesting possibilities for 
> > exploits.
> 
> Only if the application lets users directly enter lavf protocol
> strings.. However it does sound dangerous since http, etc. are
> lavf protocols too right? Is there a way to do this more securely??
> 

Having an additionnal API allocate a cookie (arbitrary number), like 
ffifstream_allocate_urlcookie(), and use that as a once only key in 
url_open()...
Or just the same hack I did, opening something else and stuffing our 
object inside, but it's ugly and could break anytime someone changes 
the struct.

Fran?ois.




More information about the ffmpeg-devel mailing list