diff mbox

[FFmpeg-devel] avformat/hls: Fix DoS due to infinite loop

Message ID 20170825101423.4005-1-michael@niedermayer.cc
State Superseded
Headers show

Commit Message

Michael Niedermayer Aug. 25, 2017, 10:14 a.m. UTC
Fixes: loop.m3u

The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/hls.c | 7 +++++++
 1 file changed, 7 insertions(+)

Comments

Steven Liu Aug. 25, 2017, 10:49 p.m. UTC | #1
2017-08-25 18:14 GMT+08:00 Michael Niedermayer <michael@niedermayer.cc>:
> Fixes: loop.m3u
>
> The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome
>
> Found-by: Xiaohei and Wangchu from Alibaba Security Team
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/hls.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/libavformat/hls.c b/libavformat/hls.c
> index 01731bd36b..0995345bbf 100644
> --- a/libavformat/hls.c
> +++ b/libavformat/hls.c
> @@ -205,6 +205,7 @@ typedef struct HLSContext {
>      AVDictionary *avio_opts;
>      int strict_std_compliance;
>      char *allowed_extensions;
> +    int max_reload;
>  } HLSContext;
>
>  static int read_chomp_line(AVIOContext *s, char *buf, int maxlen)
> @@ -1263,6 +1264,7 @@ static int read_data(void *opaque, uint8_t *buf, int buf_size)
>      HLSContext *c = v->parent->priv_data;
>      int ret, i;
>      int just_opened = 0;
> +    int reload_count = 0;
>
>  restart:
>      if (!v->needed)
> @@ -1294,6 +1296,9 @@ restart:
>          reload_interval = default_reload_interval(v);
>
>  reload:
> +        reload_count++;
> +        if (reload_count > c->max_reload)
> +            return AVERROR_EOF;
>          if (!v->finished &&
>              av_gettime_relative() - v->last_load_time >= reload_interval) {
>              if ((ret = parse_playlist(c, v->url, v, NULL)) < 0) {
> @@ -2150,6 +2155,8 @@ static const AVOption hls_options[] = {
>          OFFSET(allowed_extensions), AV_OPT_TYPE_STRING,
>          {.str = "3gp,aac,avi,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,wav"},
>          INT_MIN, INT_MAX, FLAGS},
> +    {"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded",
> +        OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 1000}, 0, INT_MAX, FLAGS},
>      {NULL}
>  };
>
> --
> 2.14.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel


should be ok,  and the demuxer option need a document.
Michael Niedermayer Aug. 25, 2017, 11:30 p.m. UTC | #2
On Sat, Aug 26, 2017 at 06:49:00AM +0800, Steven Liu wrote:
> 2017-08-25 18:14 GMT+08:00 Michael Niedermayer <michael@niedermayer.cc>:
> > Fixes: loop.m3u
> >
> > The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome
> >
> > Found-by: Xiaohei and Wangchu from Alibaba Security Team
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavformat/hls.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> >
> > diff --git a/libavformat/hls.c b/libavformat/hls.c
> > index 01731bd36b..0995345bbf 100644
> > --- a/libavformat/hls.c
> > +++ b/libavformat/hls.c
> > @@ -205,6 +205,7 @@ typedef struct HLSContext {
> >      AVDictionary *avio_opts;
> >      int strict_std_compliance;
> >      char *allowed_extensions;
> > +    int max_reload;
> >  } HLSContext;
> >
> >  static int read_chomp_line(AVIOContext *s, char *buf, int maxlen)
> > @@ -1263,6 +1264,7 @@ static int read_data(void *opaque, uint8_t *buf, int buf_size)
> >      HLSContext *c = v->parent->priv_data;
> >      int ret, i;
> >      int just_opened = 0;
> > +    int reload_count = 0;
> >
> >  restart:
> >      if (!v->needed)
> > @@ -1294,6 +1296,9 @@ restart:
> >          reload_interval = default_reload_interval(v);
> >
> >  reload:
> > +        reload_count++;
> > +        if (reload_count > c->max_reload)
> > +            return AVERROR_EOF;
> >          if (!v->finished &&
> >              av_gettime_relative() - v->last_load_time >= reload_interval) {
> >              if ((ret = parse_playlist(c, v->url, v, NULL)) < 0) {
> > @@ -2150,6 +2155,8 @@ static const AVOption hls_options[] = {
> >          OFFSET(allowed_extensions), AV_OPT_TYPE_STRING,
> >          {.str = "3gp,aac,avi,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,wav"},
> >          INT_MIN, INT_MAX, FLAGS},
> > +    {"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded",
> > +        OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 1000}, 0, INT_MAX, FLAGS},
> >      {NULL}
> >  };
> >
> > --
> > 2.14.1
> >
> > _______________________________________________
> > ffmpeg-devel mailing list
> > ffmpeg-devel@ffmpeg.org
> > http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> 
> should be ok,  and the demuxer option need a document.

posted patch with docs

thx

[...]
diff mbox

Patch

diff --git a/libavformat/hls.c b/libavformat/hls.c
index 01731bd36b..0995345bbf 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -205,6 +205,7 @@  typedef struct HLSContext {
     AVDictionary *avio_opts;
     int strict_std_compliance;
     char *allowed_extensions;
+    int max_reload;
 } HLSContext;
 
 static int read_chomp_line(AVIOContext *s, char *buf, int maxlen)
@@ -1263,6 +1264,7 @@  static int read_data(void *opaque, uint8_t *buf, int buf_size)
     HLSContext *c = v->parent->priv_data;
     int ret, i;
     int just_opened = 0;
+    int reload_count = 0;
 
 restart:
     if (!v->needed)
@@ -1294,6 +1296,9 @@  restart:
         reload_interval = default_reload_interval(v);
 
 reload:
+        reload_count++;
+        if (reload_count > c->max_reload)
+            return AVERROR_EOF;
         if (!v->finished &&
             av_gettime_relative() - v->last_load_time >= reload_interval) {
             if ((ret = parse_playlist(c, v->url, v, NULL)) < 0) {
@@ -2150,6 +2155,8 @@  static const AVOption hls_options[] = {
         OFFSET(allowed_extensions), AV_OPT_TYPE_STRING,
         {.str = "3gp,aac,avi,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,wav"},
         INT_MIN, INT_MAX, FLAGS},
+    {"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded",
+        OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 1000}, 0, INT_MAX, FLAGS},
     {NULL}
 };