From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 998BC47566 for ; Sun, 19 Jan 2025 23:19:36 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id F298168B5CA; Mon, 20 Jan 2025 01:19:32 +0200 (EET) Received: from relay9-d.mail.gandi.net (relay9-d.mail.gandi.net [217.70.183.199]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 13A0168B498 for ; Mon, 20 Jan 2025 01:19:26 +0200 (EET) Received: by mail.gandi.net (Postfix) with ESMTPSA id 397DBFF804 for ; Sun, 19 Jan 2025 23:19:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1737328765; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=ng4sp8yNfkOq3jzwIoFpT3q0ILbU9y3Hr5rrAUJ58vQ=; b=DF/dzLuh4NH2M/bwPHQrXTkaaWyzFcMgYBkK0gPnjai0eZuHjCo3QeyzESMn6pqZ6SNfSg 8nViUVeUSBJrFPaPUG+KjZo6OE6uTRFtJer0NV7sONHvnjcZspdTLRohhI3yzQnX7mZmlH CQsUSANvjU2+NQNtbte1V3v9H5Aa6/I5iOAUTrn3FSCLIeoQiE8Fyp0H8MFJMdhtLd6PxQ WTRexP0DYZgjaeikKvokwAwBBpxs3rMUlNVbKTsvJDDvKPIziiT3Fn+7Dd7rmYsds9yKWX BS/LuW594bUQXPxtj+UQwKFDKjg1bJvkEUKodKNVjnqxv6TKnwDDIMWiavjs9w== Date: Mon, 20 Jan 2025 00:19:24 +0100 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20250119231924.GV4991@pb2> References: <20250116033951.1810913-1-michael@niedermayer.cc> <20250116033951.1810913-3-michael@niedermayer.cc> <74d0e6b4-543f-4ff3-bf86-382e6f80d989@gmail.com> MIME-Version: 1.0 In-Reply-To: <74d0e6b4-543f-4ff3-bf86-382e6f80d989@gmail.com> X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [PATCH 3/3] avformat/hls: Be more picky on extensions X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============2140920685379326148==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============2140920685379326148== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="SjCJaXdTCLkUBZAW" Content-Disposition: inline --SjCJaXdTCLkUBZAW Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi James On Fri, Jan 17, 2025 at 07:37:16PM -0300, James Almer wrote: > On 1/16/2025 12:39 AM, Michael Niedermayer wrote: > > This blocks disallowed extensions from probing > > It also requires segments to have matching extensions to the format > >=20 > > It is recommended to set the whitelists correctly > > instead of depending on extensions, but this should help a bit, > > and this is easier to backport > >=20 > > Fixes: CVE-2023-6602 II. HLS Force TTY Demuxer > > Fixes: CVE-2023-6602 IV. HLS XBIN Demuxer DoS Amplification > >=20 > > The other parts of CVE-2023-6602 have been fixed by prior commits > >=20 > > Found-by: Harvey Phillips of Amazon Element55 (element55) > > Signed-off-by: Michael Niedermayer > > --- > > libavformat/hls.c | 21 +++++++++++++++++++++ > > 1 file changed, 21 insertions(+) > >=20 > > diff --git a/libavformat/hls.c b/libavformat/hls.c > > index 045741c3b4e..a802eafc3fe 100644 > > --- a/libavformat/hls.c > > +++ b/libavformat/hls.c > > @@ -223,6 +223,7 @@ typedef struct HLSContext { > > AVDictionary *avio_opts; > > AVDictionary *seg_format_opts; > > char *allowed_extensions; > > + int extension_picky; > > int max_reload; > > int http_persistent; > > int http_multiple; > > @@ -2114,6 +2115,24 @@ static int hls_read_header(AVFormatContext *s) > > pls->ctx->interrupt_callback =3D s->interrupt_callback; > > url =3D av_strdup(pls->segments[0]->url); > > ret =3D av_probe_input_buffer(&pls->pb.pub, &in_fmt, url,= NULL, 0, 0); > > + if (c->extension_picky && ret >=3D 0) { >=20 > This should be a check for s->strict_std_compliance instead of a new demu= xer > specific option, IMO. > Since you want the strict behavior enabled by default, make this line be: >=20 > s->strict_std_compliance >=3D FF_COMPLIANCE_NORMAL && ret >=3D 0 I have not attempted to implement any standard compliance This is an implementation of security checks to avoid the quoted issues and even if, by chance, my implementation happens to be what a standard demands. overloading strict_std_compliance with a security feature is not correct The question "do i want "bitstream level" standard compliance"? and The question "am i sure the input is fully trusted so i can turn of a security feature" / do i understand what i do and have i taken precautions like setting up whitelists target different users and different use cases thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Opposition brings concord. Out of discord comes the fairest harmony. -- Heraclitus --SjCJaXdTCLkUBZAW Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEKAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCZ42IeAAKCRBhHseHBAsP q+L7AKCOMovJ1N+YL3HavygmcGAWJoIZngCfQS+5Ri0BdclejSCuQxZ4iXzbdPk= =eIYb -----END PGP SIGNATURE----- --SjCJaXdTCLkUBZAW-- --===============2140920685379326148== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============2140920685379326148==--