diff mbox

[FFmpeg-devel,2/3] libavformat/dashdec: Fix for ticket 6658 (Dash demuxer segfault)

Message ID DM5PR22MB0681935DF8884816BAE5A8F1FEE90@DM5PR22MB0681.namprd22.prod.outlook.com
State New
Headers show

Commit Message

Colin NG Jan. 17, 2018, 9:51 p.m. UTC 
Believe the comment is related to the 3rd patch. The update version is attached.


________________________________
From: 刘歧 <lq@chinaffmpeg.org>

Sent: January 16, 2018 10:39 PM
To: FFmpeg development discussions and patches
Cc: 刘歧; Colin NG
Subject: Re: [FFmpeg-devel] [PATCH 2/3] libavformat/dashdec: Fix for ticket 6658 (Dash demuxer segfault)


> On 17 Jan 2018, at 11:00, Colin NG <colin_ng@hotmail.com> wrote:

>

> - Add function 'resolve_content_path' to propagate the baseURL from upper level nodes.

> * if no baseURL is available, the path of mpd file will be set as the baseURL.

> - Remove checking for newly established connection.

> - Establish the communication protocol in each connection rather than applying one protocol to all connection.

> ---

> libavformat/dashdec.c | 128 +++++++++++++++++++++++++++++++++++++++++++++-----

> 1 file changed, 115 insertions(+), 13 deletions(-)

>

> diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c

> index 67a92d6..1d520d4 100644

> --- a/libavformat/dashdec.c

> +++ b/libavformat/dashdec.c

> @@ -149,6 +149,11 @@ typedef struct DASHContext {

>     AVDictionary *avio_opts;

> } DASHContext;

>

> +static int ishttp(char *url) {

> +    const char *proto_name = avio_find_protocol_name(url);

> +    return av_strstart(proto_name, "http", NULL);

> +}

> +

> static uint64_t get_current_time_in_sec(void)

> {

>     return  av_gettime() / 1000000;

> @@ -420,7 +425,8 @@ static int open_url(AVFormatContext *s, AVIOContext **pb, const char *url,

>     else if (strcmp(proto_name, "file") || !strncmp(url, "file,", 5))

>         return AVERROR_INVALIDDATA;

>

> -    ret = s->io_open(s, pb, url, AVIO_FLAG_READ, &tmp);

> +    av_freep(pb);

> +    ret = avio_open2(pb, url, AVIO_FLAG_READ, c->interrupt_callback, &tmp);

>     if (ret >= 0) {

>         // update cookies on http response with setcookies.

>         char *new_cookies = NULL;

> @@ -564,6 +570,7 @@ static struct fragment * get_Fragment(char *range)

>         seg->url_offset = strtoll(str_offset, NULL, 10);

>         seg->size = strtoll(str_end_offset, NULL, 10) - seg->url_offset;

>     }

> +

>     return seg;

> }

>

> @@ -591,6 +598,7 @@ static int parse_manifest_segmenturlnode(AVFormatContext *s, struct representati

>                                                      rep_id_val,

>                                                      rep_bandwidth_val,

>                                                      initialization_val);

> +

>             if (!rep->init_section->url) {

>                 av_free(rep->init_section);

>                 xmlFree(initialization_val);

> @@ -665,6 +673,105 @@ static int parse_manifest_segmenttimeline(AVFormatContext *s, struct representat

>     return 0;

> }

>

> +static int resolve_content_path(AVFormatContext *s, const char *url, xmlNodePtr *baseurl_nodes, int n_baseurl_nodes) {

> +

> +    char *tmp_str = NULL;

> +    char *path = NULL;

> +    char *mpdName = NULL;

> +    xmlNodePtr node = NULL;

> +    char *baseurl = NULL;

> +    char *root_url = NULL;

> +    char *text = NULL;

> +

> +    int isRootHttp = 0;

> +    char token ='/';

> +    int start =  0;

> +    int rootId = 0;

> +    int updated = 0;

> +    int size = 0;

> +    int i;

> +    int max_url_size = strlen(url);

> +

> +    for (i = n_baseurl_nodes-1; i >= 0 ; i--) {

> +        text = xmlNodeGetContent(baseurl_nodes[i]);

> +        if (!text)

> +            continue;

> +        max_url_size += strlen(text);

> +        if (ishttp(text)) {

> +            xmlFree(text);

> +            break;

> +        }

> +        xmlFree(text);

> +    }

> +

> +    text = av_mallocz(max_url_size);

> +    if (!text) {

> +        updated = AVERROR(ENOMEM);

> +        goto end;

> +    }

> +    av_strlcpy(text, url, strlen(url)+1);

> +    while (mpdName = av_strtok(text, "/", &text))  {

> +        size = strlen(mpdName);

> +    }

> +

> +    path = av_mallocz(max_url_size);

> +    tmp_str = av_mallocz(max_url_size);

> +    if (!tmp_str || !path) {

> +        updated = AVERROR(ENOMEM);

> +        goto end;

> +    }

> +

> +    av_strlcpy (path, url, strlen(url) - size + 1);

> +    for (rootId = n_baseurl_nodes - 1; rootId > 0; rootId --) {

> +        if (!(node = baseurl_nodes[rootId])) {

> +            continue;

> +        }

> +        if (ishttp(xmlNodeGetContent(node))) {

> +            break;

> +        }

> +    }

> +

> +    node = baseurl_nodes[rootId];

> +    baseurl = xmlNodeGetContent(node);

> +    root_url = (av_strcasecmp(baseurl, "")) ? baseurl : path;

> +    if (node) {

> +        xmlNodeSetContent(node, root_url);

> +        updated = 1;

> +    }

> +

> +    size = strlen(root_url);

> +    isRootHttp = ishttp(root_url);

> +

> +    if (root_url[size - 1] != token) {

> +        av_strlcat(root_url, "/", size + 2);

> +        size += 2;

> +    }

> +

> +    for (i = 0; i < n_baseurl_nodes; ++i) {

> +        if (i == rootId) {

> +            continue;

> +        }

> +        text = xmlNodeGetContent(baseurl_nodes[i]);

> +        if (text) {

> +            memset(tmp_str, 0, strlen(tmp_str));

> +            if (!ishttp(text) && isRootHttp) {

> +                av_strlcpy(tmp_str, root_url, size + 1);

> +            }

> +            start = (text[0] == token);

> +            av_strlcat(tmp_str, text + start, max_url_size);

> +            xmlNodeSetContent(baseurl_nodes[i], tmp_str);

> +            updated = 1;

> +            xmlFree(text);

> +        }

> +    }

> +

> +end:

> +    av_free(path);

> +    av_free(tmp_str);

> +    return updated;

> +

> +}

> +

> static int parse_manifest_representation(AVFormatContext *s, const char *url,

>                                          xmlNodePtr node,

>                                          xmlNodePtr adaptionset_node,

> @@ -727,6 +834,10 @@ static int parse_manifest_representation(AVFormatContext *s, const char *url,

>         baseurl_nodes[2] = adaptionset_baseurl_node;

>         baseurl_nodes[3] = representation_baseurl_node;

>

> +        ret = resolve_content_path(s, url, baseurl_nodes, 4);

> +        if (ret == AVERROR(ENOMEM) || (ret == 0)) {

> +            goto end;

> +        }

>         if (representation_segmenttemplate_node || fragment_template_node || period_segmenttemplate_node) {

>             fragment_timeline_node = NULL;

>             fragment_templates_tab[0] = representation_segmenttemplate_node;

> @@ -1038,6 +1149,9 @@ static int parse_manifest(AVFormatContext *s, const char *url, AVIOContext *in)

>         }

>

>         mpd_baseurl_node = find_child_node_by_name(node, "BaseURL");

> +        if (!mpd_baseurl_node) {

> +            mpd_baseurl_node = xmlNewNode(NULL, "BaseURL");

> +        }

>

>         // at now we can handle only one period, with the longest duration

>         node = xmlFirstElementChild(node);

> @@ -1405,18 +1519,6 @@ static int open_input(DASHContext *c, struct representation *pls, struct fragmen

>         goto cleanup;

>     }

>

> -    /* Seek to the requested position. If this was a HTTP request, the offset

> -     * should already be where want it to, but this allows e.g. local testing

> -     * without a HTTP server. */

> -    if (!ret && seg->url_offset) {

> -        int64_t seekret = avio_seek(pls->input, seg->url_offset, SEEK_SET);

> -        if (seekret < 0) {

> -            av_log(pls->parent, AV_LOG_ERROR, "Unable to seek to offset %"PRId64" of DASH fragment '%s'\n", seg->url_offset, seg->url);

> -            ret = (int) seekret;

> -            ff_format_io_close(pls->parent, &pls->input);

> -        }

> -    }

> -

> cleanup:

>     av_dict_free(&opts);

>     pls->cur_seg_offset = 0;

> --

> 2.7.4

>



Patchset LGTM, but there have some compiling warning:

liuqideMacBook-Pro:dash liuqi$ make
CC      libavformat/dashdec.o
src/libavformat/dashdec.c:1530:9: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
    if (!url) {
        ^~~~
src/libavformat/dashdec.c:1554:12: note: uninitialized use occurs here
    return ret;
           ^~~
src/libavformat/dashdec.c:1530:5: note: remove the 'if' if its condition is always false
    if (!url) {
    ^~~~~~~~~~~
src/libavformat/dashdec.c:1528:12: note: initialize the variable 'ret' to silence this warning
    int ret;
           ^
            = 0
1 warning generated.
AR      libavformat/libavformat.a
LD      ffmpeg_g
diff mbox

Patch

From 3914b893e6f21eb25e8e29ba94d1f78401012bf7 Mon Sep 17 00:00:00 2001
From: Colin Ng <colin_ng@hotmail.com>
Date: Wed, 17 Jan 2018 13:46:08 -0800
Subject: [PATCH 3/3] libavformat/dashdec: Fix for ticket 6856 (filename
 limited to 1024)

---
 libavformat/dashdec.c | 89 ++++++++++++++++++++++++++++++++++-----------------
 1 file changed, 59 insertions(+), 30 deletions(-)

diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index 1d520d4..a41b3ae 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -147,6 +147,7 @@  typedef struct DASHContext {
     char *headers;                       ///< holds HTTP headers set as an AVOption to the HTTP protocol context
     char *allowed_extensions;
     AVDictionary *avio_opts;
+    int max_url_size;
 } DASHContext;
 
 static int ishttp(char *url) {
@@ -154,6 +155,10 @@  static int ishttp(char *url) {
     return av_strstart(proto_name, "http", NULL);
 }
 
+static int aligned(int val) {
+    return ((val + 0x3F) >> 6) << 6;
+}
+
 static uint64_t get_current_time_in_sec(void)
 {
     return  av_gettime() / 1000000;
@@ -452,6 +457,7 @@  static int open_url(AVFormatContext *s, AVIOContext **pb, const char *url,
 
 static char *get_content_url(xmlNodePtr *baseurl_nodes,
                              int n_baseurl_nodes,
+                             int max_url_size,
                              char *rep_id_val,
                              char *rep_bandwidth_val,
                              char *val)
@@ -459,43 +465,47 @@  static char *get_content_url(xmlNodePtr *baseurl_nodes,
     int i;
     char *text;
     char *url = NULL;
-    char tmp_str[MAX_URL_SIZE];
-    char tmp_str_2[MAX_URL_SIZE];
-
-    memset(tmp_str, 0, sizeof(tmp_str));
+    char *tmp_str = av_mallocz(max_url_size);
+    char *tmp_str_2 = av_mallocz(max_url_size);
 
+    if (!tmp_str || !tmp_str_2) {
+        return NULL;
+    }
     for (i = 0; i < n_baseurl_nodes; ++i) {
         if (baseurl_nodes[i] &&
             baseurl_nodes[i]->children &&
             baseurl_nodes[i]->children->type == XML_TEXT_NODE) {
             text = xmlNodeGetContent(baseurl_nodes[i]->children);
             if (text) {
-                memset(tmp_str, 0, sizeof(tmp_str));
-                memset(tmp_str_2, 0, sizeof(tmp_str_2));
-                ff_make_absolute_url(tmp_str_2, MAX_URL_SIZE, tmp_str, text);
-                av_strlcpy(tmp_str, tmp_str_2, sizeof(tmp_str));
+                memset(tmp_str, 0, max_url_size);
+                memset(tmp_str_2, 0, max_url_size);
+                ff_make_absolute_url(tmp_str_2, max_url_size, tmp_str, text);
+                av_strlcpy(tmp_str, tmp_str_2, max_url_size);
                 xmlFree(text);
             }
         }
     }
 
     if (val)
-        av_strlcat(tmp_str, (const char*)val, sizeof(tmp_str));
+        av_strlcat(tmp_str, (const char*)val, max_url_size);
 
     if (rep_id_val) {
         url = av_strireplace(tmp_str, "$RepresentationID$", (const char*)rep_id_val);
         if (!url) {
-            return NULL;
+            goto end;
         }
-        av_strlcpy(tmp_str, url, sizeof(tmp_str));
+        av_strlcpy(tmp_str, url, max_url_size);
         av_free(url);
     }
     if (rep_bandwidth_val && tmp_str[0] != '\0') {
         url = av_strireplace(tmp_str, "$Bandwidth$", (const char*)rep_bandwidth_val);
         if (!url) {
-            return NULL;
+            goto end;
         }
     }
+end:
+    av_free(tmp_str);
+    av_free(tmp_str_2);
     return url;
 }
 
@@ -580,9 +590,11 @@  static int parse_manifest_segmenturlnode(AVFormatContext *s, struct representati
                                          char *rep_id_val,
                                          char *rep_bandwidth_val)
 {
+    DASHContext *c = s->priv_data;
     char *initialization_val = NULL;
     char *media_val = NULL;
     char *range_val = NULL;
+    int max_url_size = c ? c->max_url_size: MAX_URL_SIZE;
 
     if (!av_strcasecmp(fragmenturl_node->name, (const char *)"Initialization")) {
         initialization_val = xmlGetProp(fragmenturl_node, "sourceURL");
@@ -595,6 +607,7 @@  static int parse_manifest_segmenturlnode(AVFormatContext *s, struct representati
                 return AVERROR(ENOMEM);
             }
             rep->init_section->url = get_content_url(baseurl_nodes, 4,
+                                                     max_url_size,
                                                      rep_id_val,
                                                      rep_bandwidth_val,
                                                      initialization_val);
@@ -619,6 +632,7 @@  static int parse_manifest_segmenturlnode(AVFormatContext *s, struct representati
                 return AVERROR(ENOMEM);
             }
             seg->url = get_content_url(baseurl_nodes, 4,
+                                       max_url_size,
                                        rep_id_val,
                                        rep_bandwidth_val,
                                        media_val);
@@ -673,7 +687,7 @@  static int parse_manifest_segmenttimeline(AVFormatContext *s, struct representat
     return 0;
 }
 
-static int resolve_content_path(AVFormatContext *s, const char *url, xmlNodePtr *baseurl_nodes, int n_baseurl_nodes) {
+static int resolve_content_path(AVFormatContext *s, const char *url, int *max_url_size, xmlNodePtr *baseurl_nodes, int n_baseurl_nodes) {
 
     char *tmp_str = NULL;
     char *path = NULL;
@@ -690,13 +704,13 @@  static int resolve_content_path(AVFormatContext *s, const char *url, xmlNodePtr
     int updated = 0;
     int size = 0;
     int i;
-    int max_url_size = strlen(url);
+    int tmp_max_url_size = strlen(url);
 
     for (i = n_baseurl_nodes-1; i >= 0 ; i--) {
         text = xmlNodeGetContent(baseurl_nodes[i]);
         if (!text)
             continue;
-        max_url_size += strlen(text);
+        tmp_max_url_size += strlen(text);
         if (ishttp(text)) {
             xmlFree(text);
             break;
@@ -704,7 +718,8 @@  static int resolve_content_path(AVFormatContext *s, const char *url, xmlNodePtr
         xmlFree(text);
     }
 
-    text = av_mallocz(max_url_size);
+    tmp_max_url_size = aligned(tmp_max_url_size);
+    text = av_mallocz(tmp_max_url_size);
     if (!text) {
         updated = AVERROR(ENOMEM);
         goto end;
@@ -714,8 +729,8 @@  static int resolve_content_path(AVFormatContext *s, const char *url, xmlNodePtr
         size = strlen(mpdName);
     }
 
-    path = av_mallocz(max_url_size);
-    tmp_str = av_mallocz(max_url_size);
+    path = av_mallocz(tmp_max_url_size);
+    tmp_str = av_mallocz(tmp_max_url_size);
     if (!tmp_str || !path) {
         updated = AVERROR(ENOMEM);
         goto end;
@@ -758,7 +773,7 @@  static int resolve_content_path(AVFormatContext *s, const char *url, xmlNodePtr
                 av_strlcpy(tmp_str, root_url, size + 1);
             }
             start = (text[0] == token);
-            av_strlcat(tmp_str, text + start, max_url_size);
+            av_strlcat(tmp_str, text + start, tmp_max_url_size);
             xmlNodeSetContent(baseurl_nodes[i], tmp_str);
             updated = 1;
             xmlFree(text);
@@ -766,6 +781,9 @@  static int resolve_content_path(AVFormatContext *s, const char *url, xmlNodePtr
     }
 
 end:
+    if (tmp_max_url_size > *max_url_size) {
+        *max_url_size = tmp_max_url_size;
+    }
     av_free(path);
     av_free(tmp_str);
     return updated;
@@ -834,8 +852,9 @@  static int parse_manifest_representation(AVFormatContext *s, const char *url,
         baseurl_nodes[2] = adaptionset_baseurl_node;
         baseurl_nodes[3] = representation_baseurl_node;
 
-        ret = resolve_content_path(s, url, baseurl_nodes, 4);
-        if (ret == AVERROR(ENOMEM) || (ret == 0)) {
+        ret = resolve_content_path(s, url, &c->max_url_size, baseurl_nodes, 4);
+        c->max_url_size = aligned(c->max_url_size  + strlen(rep_id_val) + strlen(rep_bandwidth_val));
+        if (ret == AVERROR(ENOMEM) || ret == 0) {
             goto end;
         }
         if (representation_segmenttemplate_node || fragment_template_node || period_segmenttemplate_node) {
@@ -859,7 +878,8 @@  static int parse_manifest_representation(AVFormatContext *s, const char *url,
                     ret = AVERROR(ENOMEM);
                     goto end;
                 }
-                rep->init_section->url = get_content_url(baseurl_nodes, 4, rep_id_val, rep_bandwidth_val, initialization_val);
+                c->max_url_size = aligned(c->max_url_size  + strlen(initialization_val));
+                rep->init_section->url = get_content_url(baseurl_nodes, 4,  c->max_url_size, rep_id_val, rep_bandwidth_val, initialization_val);
                 if (!rep->init_section->url) {
                     av_free(rep->init_section);
                     av_free(rep);
@@ -871,7 +891,8 @@  static int parse_manifest_representation(AVFormatContext *s, const char *url,
             }
 
             if (media_val) {
-                rep->url_template = get_content_url(baseurl_nodes, 4, rep_id_val, rep_bandwidth_val, media_val);
+                c->max_url_size = aligned(c->max_url_size  + strlen(media_val));
+                rep->url_template = get_content_url(baseurl_nodes, 4, c->max_url_size, rep_id_val, rep_bandwidth_val, media_val);
                 xmlFree(media_val);
             }
 
@@ -914,7 +935,7 @@  static int parse_manifest_representation(AVFormatContext *s, const char *url,
                 ret = AVERROR(ENOMEM);
                 goto end;
             }
-            seg->url = get_content_url(baseurl_nodes, 4, rep_id_val, rep_bandwidth_val, NULL);
+            seg->url = get_content_url(baseurl_nodes, 4, c->max_url_size, rep_id_val, rep_bandwidth_val, NULL);
             if (!seg->url) {
                 av_free(seg);
                 ret = AVERROR(ENOMEM);
@@ -1449,19 +1470,22 @@  static struct fragment *get_current_fragment(struct representation *pls)
         }
     }
     if (seg) {
-        char tmpfilename[MAX_URL_SIZE];
-
-        ff_dash_fill_tmpl_params(tmpfilename, sizeof(tmpfilename), pls->url_template, 0, pls->cur_seq_no, 0, get_segment_start_time_based_on_timeline(pls, pls->cur_seq_no));
+        char *tmpfilename= av_mallocz(c->max_url_size);
+        if (!tmpfilename) {
+            return NULL;
+        }
+        ff_dash_fill_tmpl_params(tmpfilename, c->max_url_size, pls->url_template, 0, pls->cur_seq_no, 0, get_segment_start_time_based_on_timeline(pls, pls->cur_seq_no));
         seg->url = av_strireplace(pls->url_template, pls->url_template, tmpfilename);
         if (!seg->url) {
             av_log(pls->parent, AV_LOG_WARNING, "Unable to resolve template url '%s', try to use origin template\n", pls->url_template);
             seg->url = av_strdup(pls->url_template);
             if (!seg->url) {
                 av_log(pls->parent, AV_LOG_ERROR, "Cannot resolve template url '%s'\n", pls->url_template);
+                av_free(tmpfilename);
                 return NULL;
             }
         }
-
+        av_free(tmpfilename);
         seg->size = -1;
     }
 
@@ -1500,9 +1524,13 @@  static int read_from_url(struct representation *pls, struct fragment *seg,
 static int open_input(DASHContext *c, struct representation *pls, struct fragment *seg)
 {
     AVDictionary *opts = NULL;
-    char url[MAX_URL_SIZE];
+    char *url = av_mallocz(c->max_url_size);
     int ret;
 
+    if (!url) {
+        ret = AVERROR(ENOMEM);
+        goto cleanup;
+    }
     set_httpheader_options(c, &opts);
     if (seg->size >= 0) {
         /* try to restrict the HTTP request to the part we want
@@ -1511,7 +1539,7 @@  static int open_input(DASHContext *c, struct representation *pls, struct fragmen
         av_dict_set_int(&opts, "end_offset", seg->url_offset + seg->size, 0);
     }
 
-    ff_make_absolute_url(url, MAX_URL_SIZE, c->base_url, seg->url);
+    ff_make_absolute_url(url, c->max_url_size, c->base_url, seg->url);
     av_log(pls->parent, AV_LOG_VERBOSE, "DASH request for url '%s', offset %"PRId64", playlist %d\n",
            url, seg->url_offset, pls->rep_idx);
     ret = open_url(pls->parent, &pls->input, url, c->avio_opts, opts, NULL);
@@ -1520,6 +1548,7 @@  static int open_input(DASHContext *c, struct representation *pls, struct fragmen
     }
 
 cleanup:
+    av_free(url);
     av_dict_free(&opts);
     pls->cur_seg_offset = 0;
     pls->cur_seg_size = seg->size;
-- 
2.7.4