Re: [FFmpeg-devel] [PATCH 2/2] avformat/hls: .ts is always ok even if its a mov/mp4

From: Michael Niedermayer <michael@niedermayer.cc>
To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Subject: Re: [FFmpeg-devel] [PATCH 2/2] avformat/hls: .ts is always ok even if its a mov/mp4
Date: Tue, 28 Jan 2025 23:24:38 +0100
Message-ID: <20250128222438.GZ4991@pb2> (raw)
In-Reply-To: <CAEu79Sb5rnEXZz5ZYyrpbKVqfBtAncEN07uBLYiLMr8o2uJYYA@mail.gmail.com>

[-- Attachment #1.1: Type: text/plain, Size: 2055 bytes --]

Hi

On Tue, Jan 28, 2025 at 10:12:30PM +0200, Jan Ekström wrote:
> On Tue, Jan 28, 2025 at 4:24 PM Michael Niedermayer
> <michael@niedermayer.cc> wrote:
> >
> > Maybe fixes: 11435
> >
> 
> Do I understand correctly that the root issue that's being attempted
> to be fixed by the initial patch set is that unusual demuxers were
> possible to have been probed and opened through the HLS meta demuxer?
> In that case I would say that instead of trying to make very nebulous
> and easily breakable extension based checking, maybe this demuxer
> should just limit its default usable input formats?
> 

> To my knowledge the officially utilized container formats for HLS are
> MPEG-TS, MP4-likes (fragmented mp4) and raw audio formats such as AAC,
> MP3 or AC-3. One could check what hls.js or ExoPlayer support, and
> that should be a generally mostly encompassing thing that does not
> depend on what extensions are in use. Adding an AVOption to add
> additional formats without code changes would then allow for some
> outliers to be added by users.

our allowed_extensions list kind of does this already now
because with extension_picky (the default now)
the probed format must itself declare an extension thats on
allowed_extensions

so tty can not be used with hls unless one adds it to allowed_extensions
completely independant of what extension the files have

also any demuxers not listing any extensions can not be used with
extension_picky, excpt mpegts which is added as a special case

The idea of extension_picky is that everything has to match
its not just a check on the file extension of the file
(well at least thats the idea until the next security researcher
finds a way around it)

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Breaking DRM is a little like attempting to break through a door even
though the window is wide open and the only thing in the house is a bunch
of things you dont want and which you would get tomorrow for free anyway

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".