From patchwork Fri Jun 2 19:19:14 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 3801 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.103.10.2 with SMTP id 2csp337292vsk; Fri, 2 Jun 2017 12:19:27 -0700 (PDT) X-Received: by 10.28.175.136 with SMTP id y130mr559777wme.112.1496431167316; Fri, 02 Jun 2017 12:19:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1496431167; cv=none; d=google.com; s=arc-20160816; b=AU2GfelSduKuFfxnqtcygpWU1GEMD+iqV90tnSBvt651IWClMf1TgAksfXjw/pXW+k 5+yXaQUjpgzCGCEwVs40dUlGCNo4WYgvSkvFWPMf/xK/AkXxJ0mt/8OSdTsPiIhaUa4l c2EAK68jD7YNQNvnUDT1qGUpXRlFiYkmCTGt0C499NYWfHQS1ruO8niYqG1WK1uqOcVS Q2P7HFPKEgGI6+5vsGSKorkygK/W4HxguDi2bHPFKiFj5BhX0GHhh4NPYGiJJeLDR+Jb j0d24h37YTqlfqM9+RTdfMwYnVJEsPPNtlS1nY4ABQyBwtl/4sqiSAWUwQQxpq8dnaZJ 0mWA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:message-id:date:to:from:delivered-to :arc-authentication-results; bh=fnxmPvTxndF1dLP9YWEfRn3+AWRKNElAjuzyT0AhNvA=; b=d5qh50LXrDsSKxPx4unL7NVNcUySeqDAl1NeM0K7NC/7Ce7PB37zJQbmtRF0KqXigi 6uD6WkRIAGl1YN9jhqFbxcsVOQXNdtdlh4Duc/aWoHAzr8ech5rA+FeorEUI23cEe6lF P7EnFxZgufeixRw2TPK5ZhVlfGaVp28Iv78NdqikXyoPdIeZHVo+KEMIclziD/r5bI8r Z5aa6b7oryKGhWPkmI4mq9mvltJcMv3NiFj61XiSLaBNb50FdM93T4m1w8zd7c1y+7L8 RiNsoYnLyNb1C4/kK8ZwUExS1rHeiEFuceR8+5exxZGJRzyl04f9oI1+ErbQs24MZ7N+ gA+Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id y9si3322892wmb.144.2017.06.02.12.19.26; Fri, 02 Jun 2017 12:19:27 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id E44BE689C13; Fri, 2 Jun 2017 22:19:17 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe05-1.mx.upcmail.net (vie01a-dmta-pe06-1.mx.upcmail.net [84.116.36.14]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 5200E689BB8 for ; Fri, 2 Jun 2017 22:19:11 +0300 (EEST) Received: from [172.31.216.43] (helo=vie01a-pemc-psmtp-pe01) by vie01a-dmta-pe06.mx.upcmail.net with esmtp (Exim 4.88) (envelope-from ) id 1dGs6O-0000kL-FG for ffmpeg-devel@ffmpeg.org; Fri, 02 Jun 2017 21:19:16 +0200 Received: from localhost ([213.47.41.20]) by vie01a-pemc-psmtp-pe01 with SMTP @ mailcloud.upcmail.net id TvKF1v00Y0S5wYM01vKGas; Fri, 02 Jun 2017 21:19:16 +0200 X-SourceIP: 213.47.41.20 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Fri, 2 Jun 2017 21:19:14 +0200 Message-Id: <20170602191914.32001-1-michael@niedermayer.cc> X-Mailer: git-send-email 2.13.0 Subject: [FFmpeg-devel] [PATCH] avformat/hls: Check file extensions X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" This reduces the attack surface of local file-system and local network information leaking. It prevents the existing exploit leading to an information leak. As well as similar hypothetical attacks. Leaks of information from files and symlinks ending in common multimedia extensions are still possible. But files with sensitive information like private keys and passwords generally do not use common multimedia filename extensions. The existing exploit depends on a specific decoder as well. It does appear though that the exploit should be possible with any decoder. The problem is that as long as sensitive information gets into the decoder, the output of the decoder becomes sensitive as well. The only obvious solution is to prevent access to sensitive information. Or to disable hls or possibly some of its feature. More complex solutions like checking the path to limit access to only subdirectories of the hls path may work as an alternative. But such solutions are fragile and tricky to implement portably and would not stop every possible attack nor would they work with all valid hls files. Developers have expressed their dislike / objected to disabling hls by default as well as disabling hls with local files. This here is a less robust but also lower inconvenience solution. It can be applied stand alone or together with other solutions. Found-by: Emil Lerner and Pavel Cheremushkin Reported-by: Thierry Foucu Signed-off-by: Michael Niedermayer --- libavformat/hls.c | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index 4b8fb19a52..74bd87aebc 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -204,6 +204,7 @@ typedef struct HLSContext { char *http_proxy; ///< holds the address of the HTTP proxy server AVDictionary *avio_opts; int strict_std_compliance; + char *allowed_extensions; } HLSContext; static int read_chomp_line(AVIOContext *s, char *buf, int maxlen) @@ -602,6 +603,8 @@ static int open_url(AVFormatContext *s, AVIOContext **pb, const char *url, AVDictionary *tmp = NULL; const char *proto_name = NULL; int ret; + char filename_buffer[1024]; + const char *filename; av_dict_copy(&tmp, opts, 0); av_dict_copy(&tmp, opts2, 0); @@ -618,8 +621,26 @@ static int open_url(AVFormatContext *s, AVIOContext **pb, const char *url, return AVERROR_INVALIDDATA; // only http(s) & file are allowed - if (!av_strstart(proto_name, "http", NULL) && !av_strstart(proto_name, "file", NULL)) + if (av_strstart(proto_name, "file", NULL)) { + filename = url; + } else if (av_strstart(proto_name, "http", NULL)) { + filename = filename_buffer; + av_url_split(NULL, 0, NULL, 0, NULL, 0,NULL, + filename_buffer, sizeof(filename_buffer), + url); + if (strlen(filename_buffer) + 1 >= sizeof(filename_buffer)) + return AVERROR_INVALIDDATA; + } else + return AVERROR_INVALIDDATA; + + if (strcmp(c->allowed_extensions, "ALL") && !av_match_ext(filename, c->allowed_extensions)) { + av_log(s, AV_LOG_ERROR, + "Filename extension of \'%s\' is not a common multimedia extension, blocked for security reasons.\n" + "If you wish to override this adjust allowed_extensions, you can set it to \'ALL\' to allow all\n", + filename); return AVERROR_INVALIDDATA; + } + if (!strncmp(proto_name, url, strlen(proto_name)) && url[strlen(proto_name)] == ':') ; else if (av_strstart(url, "crypto", NULL) && !strncmp(proto_name, url + 7, strlen(proto_name)) && url[7 + strlen(proto_name)] == ':') @@ -2134,6 +2155,10 @@ static int hls_probe(AVProbeData *p) static const AVOption hls_options[] = { {"live_start_index", "segment index to start live streams at (negative values are from the end)", OFFSET(live_start_index), AV_OPT_TYPE_INT, {.i64 = -3}, INT_MIN, INT_MAX, FLAGS}, + {"allowed_extensions", "List of file extensions that hls is allowed to access", + OFFSET(allowed_extensions), AV_OPT_TYPE_STRING, + {.str = "3gp,aac,avi,flac,mkv,m3u8,m4a,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,wav"}, + INT_MIN, INT_MAX, FLAGS}, {NULL} };