[FFmpeg-devel] [PATCH] avformat/hls: Fix DoS due to infinite loop
Michael Niedermayer
michael at niedermayer.cc
Sat Aug 26 02:30:26 EEST 2017
On Sat, Aug 26, 2017 at 06:49:00AM +0800, Steven Liu wrote:
> 2017-08-25 18:14 GMT+08:00 Michael Niedermayer <michael at niedermayer.cc>:
> > Fixes: loop.m3u
> >
> > The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome
> >
> > Found-by: Xiaohei and Wangchu from Alibaba Security Team
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> > libavformat/hls.c | 7 +++++++
> > 1 file changed, 7 insertions(+)
> >
> > diff --git a/libavformat/hls.c b/libavformat/hls.c
> > index 01731bd36b..0995345bbf 100644
> > --- a/libavformat/hls.c
> > +++ b/libavformat/hls.c
> > @@ -205,6 +205,7 @@ typedef struct HLSContext {
> > AVDictionary *avio_opts;
> > int strict_std_compliance;
> > char *allowed_extensions;
> > + int max_reload;
> > } HLSContext;
> >
> > static int read_chomp_line(AVIOContext *s, char *buf, int maxlen)
> > @@ -1263,6 +1264,7 @@ static int read_data(void *opaque, uint8_t *buf, int buf_size)
> > HLSContext *c = v->parent->priv_data;
> > int ret, i;
> > int just_opened = 0;
> > + int reload_count = 0;
> >
> > restart:
> > if (!v->needed)
> > @@ -1294,6 +1296,9 @@ restart:
> > reload_interval = default_reload_interval(v);
> >
> > reload:
> > + reload_count++;
> > + if (reload_count > c->max_reload)
> > + return AVERROR_EOF;
> > if (!v->finished &&
> > av_gettime_relative() - v->last_load_time >= reload_interval) {
> > if ((ret = parse_playlist(c, v->url, v, NULL)) < 0) {
> > @@ -2150,6 +2155,8 @@ static const AVOption hls_options[] = {
> > OFFSET(allowed_extensions), AV_OPT_TYPE_STRING,
> > {.str = "3gp,aac,avi,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,wav"},
> > INT_MIN, INT_MAX, FLAGS},
> > + {"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded",
> > + OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 1000}, 0, INT_MAX, FLAGS},
> > {NULL}
> > };
> >
> > --
> > 2.14.1
> >
> > _______________________________________________
> > ffmpeg-devel mailing list
> > ffmpeg-devel at ffmpeg.org
> > http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
>
> should be ok, and the demuxer option need a document.
posted patch with docs
thx
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
Rewriting code that is poorly written but fully understood is good.
Rewriting code that one doesnt understand is a sign that one is less smart
then the original author, trying to rewrite it will not make it better.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20170826/2aff5dce/attachment.sig>
More information about the ffmpeg-devel
mailing list