[Libav-user] rtsp base64 encoded credentials

[Richard Lince]

Hi all,

I've done a little more digging with a bug which I believe must be quite 
common, string parsing at "av_url_split" for authentication extraction.
The issue exists in v4.2.2.

line 4817 - libavformat/utils.c 
<https://github.com/FFmpeg/FFmpeg/commit/554576b6cfe79a91d37e14d3617ca417562085db#diff-b45fad75a4dfb82ef50e978d38dc2649>

ls = p + strcspn(p, "/?#");

This does not permit  passwords or user names with the characters:
"/?#"

Can anyone confirm this to be the case or not please.

example:
"rtsp://admin:bob#bob@192.168.0.1:544/27f255e7-07be-38b7-83a3-fec9072713de"

last commit (however always perhaps broken)
https://github.com/FFmpeg/FFmpeg/commit/554576b6cfe79a91d37e14d3617ca417562085db#diff-b45fad75a4dfb82ef50e978d38dc2649

Cheers.
Rich.

On 08/04/2020 16:42, Richard Lince wrote:
> Hi,
> I'm looking at a way to use a base64 digest string as input into the 
> "avformat_open_input" call for the credentials portion.
> Sure that you would normally use:
> rtsp://user:pass@192.168.0.30/live/ch00_0
> format as an example, however, this format does not account for 
> invalid characters that are valid password characters, examples:
> @password
> password/\""
> password/""password/""
> password""password""
>
> Perhaps a method exists that I'm unaware of, any ideas welcome.
> Cheers,
> Rich.
> logo
>
> _______________________________________________
> Libav-user mailing list
> Libav-user at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/libav-user
>
> To unsubscribe, visit link above, or email
> libav-user-request at ffmpeg.org with subject "unsubscribe".

Best Regards,
Richard Lince,
Owner and Founder

bluebox.video <https://www.bluebox.video>
+44(0)7841665146
Skype: richard.lince77

logo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://ffmpeg.org/pipermail/libav-user/attachments/20200413/fa07a8b9/attachment.html>