[FFmpeg-devel] [PATCH 6/6] avformat/hls: Fix DoS due to infinite loop

[Steven Liu]

2017-08-25 7:15 GMT+08:00 Michael Niedermayer <michael at niedermayer.cc>:
> Fixes: loop.m3u
>
> The max iteration count of 10000 is arbitrary and ideas for a better solution are welcome
Why not give a option to user for set the reload_count and limit from 1 - 10000?

>
> Found-by: Xiaohei and Wangchu from Alibaba Security Team
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavformat/hls.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/libavformat/hls.c b/libavformat/hls.c
> index 01731bd36b..26f4ebd965 100644
> --- a/libavformat/hls.c
> +++ b/libavformat/hls.c
> @@ -1263,6 +1263,7 @@ static int read_data(void *opaque, uint8_t *buf, int buf_size)
>      HLSContext *c = v->parent->priv_data;
>      int ret, i;
>      int just_opened = 0;
> +    int reload_count = 0;
>
>  restart:
>      if (!v->needed)
> @@ -1294,6 +1295,9 @@ restart:
>          reload_interval = default_reload_interval(v);
>
>  reload:
> +        reload_count++;
> +        if (reload_count > 10000)
> +            return AVERROR_EOF;
>          if (!v->finished &&
>              av_gettime_relative() - v->last_load_time >= reload_interval) {
>              if ((ret = parse_playlist(c, v->url, v, NULL)) < 0) {
> --
> 2.14.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel