[FFmpeg-devel] [PATCH v2] avformat/hls: update current segment reference before use

[FFmpeg-devel] [PATCH v2] avformat/hls: update current segment reference before use

[Kacper Michajłow]

It may be invalidated by the time it is used.

Fixes use after free when accessing current segment.

Fixes: #10825
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
---
 libavformat/hls.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index 214a99c7ba..62473a15dd 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -2099,6 +2099,7 @@ static int hls_read_header(AVFormatContext *s)
          * If encryption scheme is SAMPLE-AES and audio setup information is present in external audio track,
          * use that information to find the media format, otherwise probe input data
          */
+        seg = current_segment(pls);
         if (seg && seg->key_type == KEY_SAMPLE_AES && pls->is_id3_timestamped &&
             pls->audio_setup_info.codec_id != AV_CODEC_ID_NONE) {
             av_assert1(pls->audio_setup_info.codec_id == AV_CODEC_ID_AAC ||
@@ -2127,6 +2128,7 @@ static int hls_read_header(AVFormatContext *s)
             av_free(url);
         }
 
+        seg = current_segment(pls);
         if (seg && seg->key_type == KEY_SAMPLE_AES) {
             if (strstr(in_fmt->name, "mov")) {
                 char key[33];
@@ -2173,6 +2175,7 @@ static int hls_read_header(AVFormatContext *s)
          * on us if they want to.
          */
         if (pls->is_id3_timestamped || (pls->n_renditions > 0 && pls->renditions[0]->type == AVMEDIA_TYPE_AUDIO)) {
+            seg = current_segment(pls);
             if (seg && seg->key_type == KEY_SAMPLE_AES && pls->audio_setup_info.setup_data_length > 0 &&
                 pls->ctx->nb_streams == 1)
                 ret = ff_hls_senc_parse_audio_setup_info(pls->ctx->streams[0], &pls->audio_setup_info);
-- 
2.43.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH v2] avformat/hls: update current segment reference before use

[J. Dekker]

Kacper Michajłow <kasper93@gmail.com> writes:

> It may be invalidated by the time it is used.
>
> Fixes use after free when accessing current segment.
>
> Fixes: #10825
> Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
> ---
>  libavformat/hls.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/libavformat/hls.c b/libavformat/hls.c
> index 214a99c7ba..62473a15dd 100644
> --- a/libavformat/hls.c
> +++ b/libavformat/hls.c
> @@ -2099,6 +2099,7 @@ static int hls_read_header(AVFormatContext *s)
>           * If encryption scheme is SAMPLE-AES and audio setup information is present in external audio track,
>           * use that information to find the media format, otherwise probe input data
>           */
> +        seg = current_segment(pls);
>          if (seg && seg->key_type == KEY_SAMPLE_AES && pls->is_id3_timestamped &&
>              pls->audio_setup_info.codec_id != AV_CODEC_ID_NONE) {
>              av_assert1(pls->audio_setup_info.codec_id == AV_CODEC_ID_AAC ||
> @@ -2127,6 +2128,7 @@ static int hls_read_header(AVFormatContext *s)
>              av_free(url);
>          }
>  
> +        seg = current_segment(pls);
>          if (seg && seg->key_type == KEY_SAMPLE_AES) {
>              if (strstr(in_fmt->name, "mov")) {
>                  char key[33];
> @@ -2173,6 +2175,7 @@ static int hls_read_header(AVFormatContext *s)
>           * on us if they want to.
>           */
>          if (pls->is_id3_timestamped || (pls->n_renditions > 0 && pls->renditions[0]->type == AVMEDIA_TYPE_AUDIO)) {
> +            seg = current_segment(pls);
>              if (seg && seg->key_type == KEY_SAMPLE_AES && pls->audio_setup_info.setup_data_length > 0 &&
>                  pls->ctx->nb_streams == 1)
>                  ret = ff_hls_senc_parse_audio_setup_info(pls->ctx->streams[0], &pls->audio_setup_info);

This fixes several twitch.tv streams which crash for me, same as in the
ticket. If no one has any comments I will push on Tuesday.

-- 
jd
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH v2] avformat/hls: update current segment reference before use

[J. Dekker]

"J. Dekker" <jdek@itanimul.li> writes:

> Kacper Michajłow <kasper93@gmail.com> writes:
>
>> It may be invalidated by the time it is used.
>>
>> Fixes use after free when accessing current segment.
>>
>> Fixes: #10825
>> Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
>> ---
>>  libavformat/hls.c | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/libavformat/hls.c b/libavformat/hls.c
>> index 214a99c7ba..62473a15dd 100644
>> --- a/libavformat/hls.c
>> +++ b/libavformat/hls.c
>> @@ -2099,6 +2099,7 @@ static int hls_read_header(AVFormatContext *s)
>>           * If encryption scheme is SAMPLE-AES and audio setup information is present in external audio track,
>>           * use that information to find the media format, otherwise probe input data
>>           */
>> +        seg = current_segment(pls);
>>          if (seg && seg->key_type == KEY_SAMPLE_AES && pls->is_id3_timestamped &&
>>              pls->audio_setup_info.codec_id != AV_CODEC_ID_NONE) {
>>              av_assert1(pls->audio_setup_info.codec_id == AV_CODEC_ID_AAC ||
>> @@ -2127,6 +2128,7 @@ static int hls_read_header(AVFormatContext *s)
>>              av_free(url);
>>          }
>>  
>> +        seg = current_segment(pls);
>>          if (seg && seg->key_type == KEY_SAMPLE_AES) {
>>              if (strstr(in_fmt->name, "mov")) {
>>                  char key[33];
>> @@ -2173,6 +2175,7 @@ static int hls_read_header(AVFormatContext *s)
>>           * on us if they want to.
>>           */
>>          if (pls->is_id3_timestamped || (pls->n_renditions > 0 && pls->renditions[0]->type == AVMEDIA_TYPE_AUDIO)) {
>> +            seg = current_segment(pls);
>>              if (seg && seg->key_type == KEY_SAMPLE_AES && pls->audio_setup_info.setup_data_length > 0 &&
>>                  pls->ctx->nb_streams == 1)
>>                  ret = ff_hls_senc_parse_audio_setup_info(pls->ctx->streams[0], &pls->audio_setup_info);
>
> This fixes several twitch.tv streams which crash for me, same as in the
> ticket. If no one has any comments I will push on Tuesday.

Pushed.

-- 
jd
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".