From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id D79B34EE68 for ; Wed, 18 Feb 2026 05:28:11 +0000 (UTC) Authentication-Results: ffbox; dkim=fail (x= value is past (b'1771279189')) header.d=walters.app header.a=rsa-sha256; dkim=fail (x= value is past (b'1771279189')) header.d=messagingengine.com header.a=rsa-sha256 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1771392459; h=to : date : message-id : mime-version : reply-to : subject : list-id : list-archive : list-archive : list-help : list-owner : list-post : list-subscribe : list-unsubscribe : from : cc : content-type : content-transfer-encoding : from; bh=k66m/byXUYUoBluJUy4QlDQuj1rfZG4qZDXlbSqQlYc=; b=mAC3p+kB7lmAsaXAg+lGE5i+Yfhyp+ie+VweH3x8N1Rtsmuk8H4v2AOf+h9C4yBMyCtHD Jh6nHpFC/WaPw0U6HHuySIKGYwi0cAA055eZSpskrD+0OYxhPI7Qo0XPCDYTTn/1D1os/Af iZdS6DobvpYsPUnMRm1DKW7nPI9OV5DACk3qmC+nLJRCuy2PvrWKYGj8ExZqbBbLj7MOZSi IBJWYffRwA4wmbtW5KgLu0maSmbhDvy9chxQmbsmAW98CRlU0/QqRvlJNl4RcIehv7G5h5c 6wxyrirO2oz4918hYc0rRDIdVqbIg4vCB2m7glTQHmuc+EMZDJsSOWic8fDQ== Received: from [172.18.0.3] (unknown [172.18.0.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 1BC8269121B; Wed, 18 Feb 2026 07:27:39 +0200 (EET) ARC-Seal: i=1; cv=none; a=rsa-sha256; d=ffmpeg.org; s=arc; t=1771392442; b=pc50opmRniCmeGZSqVAVsUIGQDkfO+2UN6VZmrP2AXg1fkzu08rGkOl+QZxX5IOX8Dl9j ELp8ormUVKaEGzzyTRIjiJ/OPcTQay5hcqCzrHYlAf71CRU2m9IhWJnnzDlZrR3Bj0g0L6K quDSlLgpLRfuWkl/f4ifn/y869Gn7R7vlTvEp3xhbxqGRxoEZgc0UHJyUi7HjPoUd2Q2bNB 8BHHa8rDQoqXvkRgdgJfpdih+831ba9LqJMSbWbmpvIiP0VQRW5ZcNvrceoR1/S+a0RrfK1 kjLXEVgkiRU6wmq00u7XSDVB1PJUSS0Ir5Md1L53w0xnfwhWwecDpr2oAucg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=ffmpeg.org; s=arc; t=1771392442; h=from : sender : reply-to : subject : date : message-id : to : cc : mime-version : content-type : content-transfer-encoding : content-id : content-description : resent-date : resent-from : resent-sender : resent-to : resent-cc : resent-message-id : in-reply-to : references : list-id : list-help : list-unsubscribe : list-subscribe : list-post : list-owner : list-archive; bh=vho/2EFnxuV7nrCO2EG4rLlTIFoIS/2dWjKVfF7kNmQ=; b=Ewb8SSrfM5nb6qZOu0ffyMysPgRGHQj5BW5qTNmZdblh+EtEGmC3W3bRzF6FObzYForkq HElEoc9lM5yub4oouHS/j9dBdvPllP+7jOFUbXH+SNl8DjiWG8GfdTs8FQIC0rn18aSItrQ +ypu+k682hpRXYHnnYpX+Dx1Qr1n96x8QGzrkAUNnii9O7W3McAiZJZVckNmD2HHOC9uhdP p93hdbsrWpfzS7V+iPDmNTUucxUiX7XpUKLPZLhztEQKKsrwL+h935HXX/u9pbxrH9c8INJ kDNdYXO3EDoLwizcdY/F8ob2M3cLWU9SYyO6K9VA86+nbPfVQDN3arNDRY1A== ARC-Authentication-Results: i=1; ffmpeg.org; dkim=fail header.d=walters.app; arc=none; dmarc=fail header.from=walters.app policy.dmarc=none Authentication-Results: ffmpeg.org; dkim=fail header.d=walters.app; arc=none (Message is not ARC signed); dmarc=fail (Used From Domain Record) header.from=walters.app policy.dmarc=none Received: from fhigh-a4-smtp.messagingengine.com (fhigh-a4-smtp.messagingengine.com [103.168.172.155]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 8F8C9691423 for ; Sun, 15 Feb 2026 23:59:50 +0200 (EET) Received: from phl-compute-06.internal (phl-compute-06.internal [10.202.2.46]) by mailfhigh.phl.internal (Postfix) with ESMTP id 0B3E71400168; Sun, 15 Feb 2026 16:59:49 -0500 (EST) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-06.internal (MEProxy); Sun, 15 Feb 2026 16:59:49 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=walters.app; h= cc:cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:message-id:mime-version:reply-to:subject:subject:to :to; s=fm3; t=1771192789; x=1771279189; bh=5ZI8JY3d9GofcNJjSqGif qIQSrVi4ZbuTySuZl8mAUA=; b=fYiMITAvmdxaEoNwZ/73V3Bujm5phYPPyFyYG EGEawDCJrFTB5xuoy0qPVHoYG2Nj20Cf+XEQl7kEeA4OWe3hq5wKDPReZ6CF/iIK wTfbo3OLN53bNBIXAHJVkTVeVpG8KO8hkgj77i/dk3Edj9CbNOpCfrTCIlTVnBZA 1Sf7AwD48nYZFI08HBTREvSu8yr63isJVB6e2n2I6zgkTXDbfA8T4OPEW8NSKuo+ iozytIHLCqID55NCqVU5tOL1LkL72bcZWNvARI+VI5BmKCKLJN3knLMMqX9Qc+d8 aRK/c2CDuA6hwcG4nC2moH10CXBk5SlQdI8rfFQtD4s6gqE7w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:message-id:mime-version:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t= 1771192789; x=1771279189; bh=5ZI8JY3d9GofcNJjSqGifqIQSrVi4ZbuTyS uZl8mAUA=; b=FbBBvLd+bM6xJN5rB4RVfQNPIchHvagrA//rHjyfT5WmLiOfnpD X34gD9BrQu6qFkJ9rUwn5dUqbDGKVUk95P/N1HKB4ygzde8zRvmmpXoMDzD+iHGy vutcUX4yYt50UaRTkU0jCxLpmVVIcz9tZdlgptzuDXECqhwC+6DVvmgLoBRdHxzZ v4lwdmoe5y3Kjt0wikw5NtIiDEjctjumxo7UUQQZQroEUN835olSRWNy6El/xXM/ JL58gFwTQmAwqCObDUtbfgxmLwRW7ukoWcbGBdVoQOwBzOspmY2wPtM1nI/cjp5E lK6bJLJnyz/peepozGvkfiIWNB+v8OFs4IA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefgedrtddtgddvudehudefucetufdoteggodetrf dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfurfetoffkrfgpnffqhgenuceu rghilhhouhhtmecufedttdenucenucfjughrpefhvfevufffkffoggfgsedtkeertdertd dtnecuhfhrohhmpeeurhgrughlvgihucghrghlthgvrhhsuceoohhsshesfigrlhhtvghr shdrrghppheqnecuggftrfgrthhtvghrnhepheegkeejfeffffdutefhleelgefgueevte eivdekjeejfeelueelheejvdfggfffnecuvehluhhsthgvrhfuihiivgeptdenucfrrghr rghmpehmrghilhhfrhhomhepohhsshesfigrlhhtvghrshdrrghpphdpnhgspghrtghpth htohepvddpmhhouggvpehsmhhtphhouhhtpdhrtghpthhtohepfhhfmhhpvghgqdguvghv vghlsehffhhmphgvghdrohhrghdprhgtphhtthhopehoshhsseifrghlthgvrhhsrdgrph hp X-ME-Proxy: Feedback-ID: i917c46d9:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sun, 15 Feb 2026 16:59:48 -0500 (EST) To: ffmpeg-devel@ffmpeg.org Date: Sun, 15 Feb 2026 13:57:01 -0800 Message-ID: <20260215215923.419212-1-oss@walters.app> X-Mailer: git-send-email 2.53.0 MIME-Version: 1.0 X-MailFrom: SRS0=o46Y=AT=walters.app=oss@ffmpeg.org X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-ffmpeg-devel.ffmpeg.org-0; header-match-ffmpeg-devel.ffmpeg.org-1; header-match-ffmpeg-devel.ffmpeg.org-2; header-match-ffmpeg-devel.ffmpeg.org-3; emergency; member-moderation Message-ID-Hash: 42SV66M7FMZ3OVC4PZMANWAYMJFA3FD4 X-Message-ID-Hash: 42SV66M7FMZ3OVC4PZMANWAYMJFA3FD4 X-Mailman-Approved-At: Wed, 18 Feb 2026 05:27:14 +0000 X-Mailman-Version: 3.3.10 Precedence: list Reply-To: FFmpeg development discussions and patches Subject: [FFmpeg-devel] [PATCH] avformat/hls: fix data: URI handling in open_url List-Id: FFmpeg development discussions and patches Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Bradley Walters via ffmpeg-devel Cc: Bradley Walters Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Archived-At: List-Archive: List-Post: The existing code for data: URIs in open_url() called avio_find_protocol_name(url + 5) which strips the 'data:' prefix and passes the MIME type portion (e.g. 'application/octet-stream;...') to protocol lookup. Since this is not a valid URL, it falls back to the 'file' protocol, which then triggers the allowed_extensions security check and blocks the URL. This breaks HLS streams that embed AES-128 decryption keys as data: URIs (e.g. data:application/octet-stream;base64,). Split the data handling into two cases: - data+: for nested protocol combinations, parse the inner protocol name as before - data:: bare data URIs, set proto_name directly to 'data' since the data protocol handler will process the full URI Signed-off-by: Bradley Walters --- My use case for this is to provide a patched manifest to ffmpeg inlining the key when the URL would otherwise require Cloudflare. libavformat/hls.c | 7 ++-- tests/Makefile | 1 + tests/fate/hlsdec.mak | 23 +++++++++++ tests/ref/fate/hls-data-uri | 82 +++++++++++++++++++++++++++++++++++++ 4 files changed, 110 insertions(+), 3 deletions(-) create mode 100644 tests/fate/hlsdec.mak create mode 100644 tests/ref/fate/hls-data-uri diff --git a/libavformat/hls.c b/libavformat/hls.c index 28c883097a..d91920feaa 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -660,9 +660,10 @@ static int open_url(AVFormatContext *s, AVIOContext **pb, const char *url, if (av_strstart(url, "crypto", NULL)) { if (url[6] == '+' || url[6] == ':') proto_name = avio_find_protocol_name(url + 7); - } else if (av_strstart(url, "data", NULL)) { - if (url[4] == '+' || url[4] == ':') - proto_name = avio_find_protocol_name(url + 5); + } else if (av_strstart(url, "data+", NULL)) { + proto_name = avio_find_protocol_name(url + 5); + } else if (av_strstart(url, "data:", NULL)) { + proto_name = "data"; } if (!proto_name) diff --git a/tests/Makefile b/tests/Makefile index 4b3fa6a54a..64e7ee4a7a 100644 --- a/tests/Makefile +++ b/tests/Makefile @@ -199,6 +199,7 @@ include $(SRC_PATH)/tests/fate/gif.mak include $(SRC_PATH)/tests/fate/h264.mak include $(SRC_PATH)/tests/fate/hap.mak include $(SRC_PATH)/tests/fate/hevc.mak +include $(SRC_PATH)/tests/fate/hlsdec.mak include $(SRC_PATH)/tests/fate/hlsenc.mak include $(SRC_PATH)/tests/fate/hw.mak include $(SRC_PATH)/tests/fate/iamf.mak diff --git a/tests/fate/hlsdec.mak b/tests/fate/hlsdec.mak new file mode 100644 index 0000000000..6151707bbf --- /dev/null +++ b/tests/fate/hlsdec.mak @@ -0,0 +1,23 @@ +# Rewrite an HLS playlist to use a data: URI for the AES-128 key. +# The key file contains the ASCII string "0000000000000000" (16 bytes of 0x30), +# which base64-encodes to MDAwMDAwMDAwMDAwMDAwMA==. +tests/data/hls_data_uri.m3u8: TAG = GEN +tests/data/hls_data_uri.m3u8: ffmpeg$(PROGSSUF)$(EXESUF) | tests/data + $(M)$(TARGET_EXEC) $(TARGET_PATH)/$< -nostdin \ + -f lavfi -i "aevalsrc=cos(2*PI*t)*sin(2*PI*(440+4*t)*t):d=2" -f hls -hls_time 1 -map 0 \ + -flags +bitexact -codec:a mp2fixed -hls_list_size 0 \ + -hls_enc 1 -hls_enc_key 00000000000000000000000000000000 \ + -hls_enc_iv 00000000000000000000000000000000 \ + -hls_segment_filename $(TARGET_PATH)/tests/data/hls_data_uri_%d.ts \ + $(TARGET_PATH)/tests/data/hls_data_uri.m3u8 2>/dev/null; \ + sed -i 's|URI="[^"]*"|URI="data:application/octet-stream;base64,MDAwMDAwMDAwMDAwMDAwMA=="|' \ + $(TARGET_PATH)/tests/data/hls_data_uri.m3u8 + +FATE_HLSDEC-$(call FILTERDEMDECENCMUX, AEVALSRC ARESAMPLE, HLS MPEGTS, MP2 PCM_F64LE, MP2FIXED, HLS MPEGTS, LAVFI_INDEV CRYPTO_PROTOCOL DATA_PROTOCOL) += fate-hls-data-uri +fate-hls-data-uri: tests/data/hls_data_uri.m3u8 +fate-hls-data-uri: CMD = framecrc -auto_conversion_filters -flags +bitexact -i $(TARGET_PATH)/tests/data/hls_data_uri.m3u8 + +FATE_HLSDEC-yes := $(if $(call FRAMECRC), $(FATE_HLSDEC-yes)) + +FATE_FFMPEG += $(FATE_HLSDEC-yes) +fate-hlsdec: $(FATE_HLSDEC-yes) diff --git a/tests/ref/fate/hls-data-uri b/tests/ref/fate/hls-data-uri new file mode 100644 index 0000000000..a4b974ee71 --- /dev/null +++ b/tests/ref/fate/hls-data-uri @@ -0,0 +1,82 @@ +#tb 0: 1/44100 +#media_type 0: audio +#codec_id 0: pcm_s16le +#sample_rate 0: 44100 +#channel_layout_name 0: mono +0, 0, 0, 1152, 2304, 0x907cb7fa +0, 1152, 1152, 1152, 2304, 0xb8dc7525 +0, 2304, 2304, 1152, 2304, 0x3e7d6905 +0, 3456, 3456, 1152, 2304, 0xef47877b +0, 4608, 4608, 1152, 2304, 0xfe916b7e +0, 5760, 5760, 1152, 2304, 0xe3d08cde +0, 6912, 6912, 1152, 2304, 0xff7f86cf +0, 8064, 8064, 1152, 2304, 0x843e6f95 +0, 9216, 9216, 1152, 2304, 0x81577c26 +0, 10368, 10368, 1152, 2304, 0x04a085d5 +0, 11520, 11520, 1152, 2304, 0x1c5a76f5 +0, 12672, 12672, 1152, 2304, 0x4ee78623 +0, 13824, 13824, 1152, 2304, 0x8ec861dc +0, 14976, 14976, 1152, 2304, 0x0ca179d8 +0, 16128, 16128, 1152, 2304, 0xc6da750f +0, 17280, 17280, 1152, 2304, 0xf6bf79b5 +0, 18432, 18432, 1152, 2304, 0x97b88a43 +0, 19584, 19584, 1152, 2304, 0xf13c7b9c +0, 20736, 20736, 1152, 2304, 0xdfba83af +0, 21888, 21888, 1152, 2304, 0xc9467d4b +0, 23040, 23040, 1152, 2304, 0xbbb58e2b +0, 24192, 24192, 1152, 2304, 0x3a1078ea +0, 25344, 25344, 1152, 2304, 0xe9587a5c +0, 26496, 26496, 1152, 2304, 0xef5a8039 +0, 27648, 27648, 1152, 2304, 0x9d5f782f +0, 28800, 28800, 1152, 2304, 0x1a548291 +0, 29952, 29952, 1152, 2304, 0x07517701 +0, 31104, 31104, 1152, 2304, 0x78127d6e +0, 32256, 32256, 1152, 2304, 0x62e2788a +0, 33408, 33408, 1152, 2304, 0x29397ad9 +0, 34560, 34560, 1152, 2304, 0x45da82d6 +0, 35712, 35712, 1152, 2304, 0x8ed66e51 +0, 36864, 36864, 1152, 2304, 0x660775cd +0, 38016, 38016, 1152, 2304, 0x802c767a +0, 39168, 39168, 1152, 2304, 0xcc055840 +0, 40320, 40320, 1152, 2304, 0x701b7eaf +0, 41472, 41472, 1152, 2304, 0x8290749f +0, 42624, 42624, 1152, 2304, 0x2c7b7d30 +0, 43776, 43776, 1152, 2304, 0xe4f17743 +0, 44928, 44928, 1152, 2304, 0x0e747d6e +0, 46080, 46080, 1152, 2304, 0xbe7775a0 +0, 47232, 47232, 1152, 2304, 0xcf797673 +0, 48384, 48384, 1152, 2304, 0x29cb7800 +0, 49536, 49536, 1152, 2304, 0xfc947890 +0, 50688, 50688, 1152, 2304, 0x62757fc6 +0, 51840, 51840, 1152, 2304, 0x098876d0 +0, 52992, 52992, 1152, 2304, 0xa9567ee2 +0, 54144, 54144, 1152, 2304, 0xe3bb9173 +0, 55296, 55296, 1152, 2304, 0xcc2d6dee +0, 56448, 56448, 1152, 2304, 0xe94591ab +0, 57600, 57600, 1152, 2304, 0x5c7588de +0, 58752, 58752, 1152, 2304, 0xfd83643c +0, 59904, 59904, 1152, 2304, 0x528177f1 +0, 61056, 61056, 1152, 2304, 0x65d08474 +0, 62208, 62208, 1152, 2304, 0x738d765b +0, 63360, 63360, 1152, 2304, 0xdd3d810e +0, 64512, 64512, 1152, 2304, 0xef4f90d3 +0, 65664, 65664, 1152, 2304, 0x61e28d43 +0, 66816, 66816, 1152, 2304, 0x9a11796b +0, 67968, 67968, 1152, 2304, 0x96c97dcd +0, 69120, 69120, 1152, 2304, 0xa8fe8621 +0, 70272, 70272, 1152, 2304, 0x499b7d38 +0, 71424, 71424, 1152, 2304, 0xfcb078a9 +0, 72576, 72576, 1152, 2304, 0x40d78651 +0, 73728, 73728, 1152, 2304, 0xa4af7234 +0, 74880, 74880, 1152, 2304, 0x6831870a +0, 76032, 76032, 1152, 2304, 0x030e7b9d +0, 77184, 77184, 1152, 2304, 0x445a75b6 +0, 78336, 78336, 1152, 2304, 0x09857389 +0, 79488, 79488, 1152, 2304, 0x0d018866 +0, 80640, 80640, 1152, 2304, 0x2afe810a +0, 81792, 81792, 1152, 2304, 0x0bcf7c43 +0, 82944, 82944, 1152, 2304, 0x13737c12 +0, 84096, 84096, 1152, 2304, 0x716c7bba +0, 85248, 85248, 1152, 2304, 0xb801823b +0, 86400, 86400, 1152, 2304, 0x0fd573ee +0, 87552, 87552, 1152, 2304, 0x83f18952 -- 2.53.0 _______________________________________________ ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org