diff mbox

[FFmpeg-devel] avformat/hls: Fix DoS due to infinite loop

Message ID 20170825232658.9495-1-michael@niedermayer.cc
State New
Headers show

Commit Message

Michael Niedermayer Aug. 25, 2017, 11:26 p.m. UTC
Fixes: loop.m3u

The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 doc/demuxers.texi | 18 ++++++++++++++++++
 libavformat/hls.c |  7 +++++++
 2 files changed, 25 insertions(+)

Comments

Michael Niedermayer Aug. 27, 2017, 5:16 p.m. UTC | #1
On Sat, Aug 26, 2017 at 01:26:58AM +0200, Michael Niedermayer wrote:
> Fixes: loop.m3u
> 
> The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome
> 
> Found-by: Xiaohei and Wangchu from Alibaba Security Team
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  doc/demuxers.texi | 18 ++++++++++++++++++
>  libavformat/hls.c |  7 +++++++
>  2 files changed, 25 insertions(+)

applied

[...]
wm4 Aug. 28, 2017, 9:21 a.m. UTC | #2
On Sun, 27 Aug 2017 19:16:03 +0200
Michael Niedermayer <michael@niedermayer.cc> wrote:

> On Sat, Aug 26, 2017 at 01:26:58AM +0200, Michael Niedermayer wrote:
> > Fixes: loop.m3u
> > 
> > The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome
> > 
> > Found-by: Xiaohei and Wangchu from Alibaba Security Team
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  doc/demuxers.texi | 18 ++++++++++++++++++
> >  libavformat/hls.c |  7 +++++++
> >  2 files changed, 25 insertions(+)  
> 
> applied
> 
> [...]

I rejected this approach, but I guess patch reviews are ignored anyway.
Michael Niedermayer Aug. 29, 2017, 1:07 a.m. UTC | #3
On Mon, Aug 28, 2017 at 11:21:39AM +0200, wm4 wrote:
> On Sun, 27 Aug 2017 19:16:03 +0200
> Michael Niedermayer <michael@niedermayer.cc> wrote:
> 
> > On Sat, Aug 26, 2017 at 01:26:58AM +0200, Michael Niedermayer wrote:
> > > Fixes: loop.m3u
> > > 
> > > The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome
> > > 
> > > Found-by: Xiaohei and Wangchu from Alibaba Security Team
> > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > > ---
> > >  doc/demuxers.texi | 18 ++++++++++++++++++
> > >  libavformat/hls.c |  7 +++++++
> > >  2 files changed, 25 insertions(+)  
> > 
> > applied
> > 
> > [...]
> 
> I rejected this approach, but I guess patch reviews are ignored anyway.

I explicitly asked if you veto this patch, you did not veto it.
It is extreemly inpolite, to ignore an explicit question about
you objecting and afterwards claim your rejection was ignored.

[...]
wm4 Aug. 29, 2017, 8:59 a.m. UTC | #4
On Tue, 29 Aug 2017 03:07:45 +0200
Michael Niedermayer <michael@niedermayer.cc> wrote:

> On Mon, Aug 28, 2017 at 11:21:39AM +0200, wm4 wrote:
> > On Sun, 27 Aug 2017 19:16:03 +0200
> > Michael Niedermayer <michael@niedermayer.cc> wrote:
> >   
> > > On Sat, Aug 26, 2017 at 01:26:58AM +0200, Michael Niedermayer wrote:  
> > > > Fixes: loop.m3u
> > > > 
> > > > The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome
> > > > 
> > > > Found-by: Xiaohei and Wangchu from Alibaba Security Team
> > > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > > > ---
> > > >  doc/demuxers.texi | 18 ++++++++++++++++++
> > > >  libavformat/hls.c |  7 +++++++
> > > >  2 files changed, 25 insertions(+)    
> > > 
> > > applied
> > > 
> > > [...]  
> > 
> > I rejected this approach, but I guess patch reviews are ignored anyway.  
> 
> I explicitly asked if you veto this patch, you did not veto it.
> It is extreemly inpolite, to ignore an explicit question about
> you objecting and afterwards claim your rejection was ignored.

I don't think a patch comment needs to be honored only if it was done
as an explicit veto. I didn't understand it this way either.
diff mbox

Patch

diff --git a/doc/demuxers.texi b/doc/demuxers.texi
index 29a23d48b2..ba4bb51177 100644
--- a/doc/demuxers.texi
+++ b/doc/demuxers.texi
@@ -300,6 +300,24 @@  used to end the output video at the length of the shortest input file,
 which in this case is @file{input.mp4} as the GIF in this example loops
 infinitely.
 
+@section hls
+
+HLS demuxer
+
+It accepts the following options:
+
+@table @option
+@item live_start_index
+segment index to start live streams at (negative values are from the end).
+
+@item allowed_extensions
+',' seperated list of file extensions that hls is allowed to access.
+
+@item max_reload
+Maximum number of times a insufficient list is attempted to be reloaded.
+Default value is 1000.
+@end table
+
 @section image2
 
 Image file demuxer.
diff --git a/libavformat/hls.c b/libavformat/hls.c
index 01731bd36b..0995345bbf 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -205,6 +205,7 @@  typedef struct HLSContext {
     AVDictionary *avio_opts;
     int strict_std_compliance;
     char *allowed_extensions;
+    int max_reload;
 } HLSContext;
 
 static int read_chomp_line(AVIOContext *s, char *buf, int maxlen)
@@ -1263,6 +1264,7 @@  static int read_data(void *opaque, uint8_t *buf, int buf_size)
     HLSContext *c = v->parent->priv_data;
     int ret, i;
     int just_opened = 0;
+    int reload_count = 0;
 
 restart:
     if (!v->needed)
@@ -1294,6 +1296,9 @@  restart:
         reload_interval = default_reload_interval(v);
 
 reload:
+        reload_count++;
+        if (reload_count > c->max_reload)
+            return AVERROR_EOF;
         if (!v->finished &&
             av_gettime_relative() - v->last_load_time >= reload_interval) {
             if ((ret = parse_playlist(c, v->url, v, NULL)) < 0) {
@@ -2150,6 +2155,8 @@  static const AVOption hls_options[] = {
         OFFSET(allowed_extensions), AV_OPT_TYPE_STRING,
         {.str = "3gp,aac,avi,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,wav"},
         INT_MIN, INT_MAX, FLAGS},
+    {"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded",
+        OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 1000}, 0, INT_MAX, FLAGS},
     {NULL}
 };