db032688df
Convert multimedia/mythtv-frontend to a slave port of multimedia/mythtv which should make future updates much easier. Upstream security patches have been added to address known vulnerabilities in the bundled ffmpeg 3.2. PR: 225652 (initial patches to update to 29.0) [1] Submitted by: <lucylangthorne55@gmail.com> [1] Differential Revision: https://reviews.freebsd.org/D14563
88 lines
3 KiB
Text
88 lines
3 KiB
Text
From 2920c7cec0b1958b59e5e7990078bea4428f6912 Mon Sep 17 00:00:00 2001
|
|
From: Michael Niedermayer <michael@niedermayer.cc>
|
|
Date: Sat, 26 Aug 2017 01:26:58 +0200
|
|
Subject: [PATCH] avformat/hls: Fix DoS due to infinite loop
|
|
|
|
Fixes: loop.m3u
|
|
|
|
The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome
|
|
|
|
Found-by: Xiaohei and Wangchu from Alibaba Security Team
|
|
|
|
Previous version reviewed-by: Steven Liu <lingjiujianke@gmail.com>
|
|
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
|
|
(cherry picked from commit 7ec414892ddcad88313848494b6fc5f437c9ca4a)
|
|
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
|
|
---
|
|
doc/demuxers.texi | 18 ++++++++++++++++++
|
|
libavformat/hls.c | 7 +++++++
|
|
2 files changed, 25 insertions(+)
|
|
|
|
diff --git doc/demuxers.texi doc/demuxers.texi
|
|
index 2934a1cf7f4..d56ad1622a8 100644
|
|
--- external/FFmpeg/doc/demuxers.texi
|
|
+++ external/FFmpeg/doc/demuxers.texi
|
|
@@ -293,6 +293,24 @@ used to end the output video at the length of the shortest input file,
|
|
which in this case is @file{input.mp4} as the GIF in this example loops
|
|
infinitely.
|
|
|
|
+@section hls
|
|
+
|
|
+HLS demuxer
|
|
+
|
|
+It accepts the following options:
|
|
+
|
|
+@table @option
|
|
+@item live_start_index
|
|
+segment index to start live streams at (negative values are from the end).
|
|
+
|
|
+@item allowed_extensions
|
|
+',' separated list of file extensions that hls is allowed to access.
|
|
+
|
|
+@item max_reload
|
|
+Maximum number of times a insufficient list is attempted to be reloaded.
|
|
+Default value is 1000.
|
|
+@end table
|
|
+
|
|
@section image2
|
|
|
|
Image file demuxer.
|
|
diff --git libavformat/hls.c libavformat/hls.c
|
|
index ffefd284f86..87948726da6 100644
|
|
--- external/FFmpeg/libavformat/hls.c
|
|
+++ external/FFmpeg/libavformat/hls.c
|
|
@@ -205,6 +205,7 @@ typedef struct HLSContext {
|
|
AVDictionary *avio_opts;
|
|
int strict_std_compliance;
|
|
char *allowed_extensions;
|
|
+ int max_reload;
|
|
} HLSContext;
|
|
|
|
static int read_chomp_line(AVIOContext *s, char *buf, int maxlen)
|
|
@@ -1255,6 +1256,7 @@ static int read_data(void *opaque, uint8_t *buf, int buf_size)
|
|
HLSContext *c = v->parent->priv_data;
|
|
int ret, i;
|
|
int just_opened = 0;
|
|
+ int reload_count = 0;
|
|
|
|
restart:
|
|
if (!v->needed)
|
|
@@ -1286,6 +1288,9 @@ static int read_data(void *opaque, uint8_t *buf, int buf_size)
|
|
reload_interval = default_reload_interval(v);
|
|
|
|
reload:
|
|
+ reload_count++;
|
|
+ if (reload_count > c->max_reload)
|
|
+ return AVERROR_EOF;
|
|
if (!v->finished &&
|
|
av_gettime_relative() - v->last_load_time >= reload_interval) {
|
|
if ((ret = parse_playlist(c, v->url, v, NULL)) < 0) {
|
|
@@ -2143,6 +2148,8 @@ static const AVOption hls_options[] = {
|
|
OFFSET(allowed_extensions), AV_OPT_TYPE_STRING,
|
|
{.str = "3gp,aac,avi,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,wav"},
|
|
INT_MIN, INT_MAX, FLAGS},
|
|
+ {"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded",
|
|
+ OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 1000}, 0, INT_MAX, FLAGS},
|
|
{NULL}
|
|
};
|
|
|