Re: [FFmpeg-devel] [PATCH v3] libavformat/dashdec: Fix buffer overflow in segment URL resolution

[jing yan <xiaohuanshu@gmail.com>]

Hi, just a gentle ping on this patch.

Let me know if anything else is needed.


Thanks!

<xiaohuanshu@gmail.com> 于2025年4月16日周三 14:56写道：

> From: xiaohuanshu <xiaohuanshu@gmail.com>
>
> Problem:
> The max_url_size calculation for DASH segment URLs only considered the
> base URL
> length, leading to buffer overflow when the segment's sourceURL exceeded
> the
> pre-allocated buffer. This triggered the log error:
> "DASH request for url 'invalid:truncated'".
>
> Reproduce:
> 1. A test sample "long-sourceurl-sample.mpd" (deliberately designed with a
> long
>    sourceURL) was uploaded to VideoLAN's repository.
> 2. Reproduce with short base path:
>    ffmpeg -i /tmp/short_path/long-sourceurl-sample.mpd
>    -> Triggers "invalid:truncated" error
> 3. With artificially lengthened base path (e.g. /aaa/../bbb/../...):
>    ffmpeg -i
> /long/../path/../with/../many/../segments/long-sourceurl-sample.mpd
>    -> URL resolves correctly (though HTTP fetch fails due to fake URL)
>
> Fix:
> Recalculate max_url_size by considering both base URL and sourceURL
> lengths,
> ensuring sufficient buffer allocation during URL concatenation.
>
> V2:
> 1. no need to determine whether initialization_val is null.
> 2. fix the incorrect variable name.
>
> V3:
> 1. change `max_url_size` scope into `Initialization` and `Media` blocks.
>
> Signed-off-by: xiaohuanshu <xiaohuanshu@gmail.com>
> ---
>  libavformat/dashdec.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
> index c3f3d7f3f8..31a84bd184 100644
> --- a/libavformat/dashdec.c
> +++ b/libavformat/dashdec.c
> @@ -606,7 +606,6 @@ static int
> parse_manifest_segmenturlnode(AVFormatContext *s, struct representati
>      char *initialization_val = NULL;
>      char *media_val = NULL;
>      char *range_val = NULL;
> -    int max_url_size = c ? c->max_url_size: MAX_URL_SIZE;
>      int err;
>
>      if (!av_strcasecmp(fragmenturl_node->name, "Initialization")) {
> @@ -620,6 +619,12 @@ static int
> parse_manifest_segmenturlnode(AVFormatContext *s, struct representati
>                  xmlFree(initialization_val);
>                  return AVERROR(ENOMEM);
>              }
> +            int max_url_size = FFMAX(
> +                c ? c->max_url_size : 0,
> +                aligned(strlen(initialization_val) +
> +                        (rep_id_val ? strlen(rep_id_val) : 0) +
> +                        (rep_bandwidth_val ? strlen(rep_bandwidth_val) :
> 0)));
> +            max_url_size = max_url_size ? max_url_size : MAX_URL_SIZE;
>              rep->init_section->url = get_content_url(baseurl_nodes, 4,
>                                                       max_url_size,
>                                                       rep_id_val,
> @@ -641,6 +646,11 @@ static int
> parse_manifest_segmenturlnode(AVFormatContext *s, struct representati
>                  xmlFree(media_val);
>                  return AVERROR(ENOMEM);
>              }
> +            int max_url_size = FFMAX(
> +                c ? c->max_url_size : 0,
> +                aligned(strlen(media_val) + (rep_id_val ?
> strlen(rep_id_val) : 0) +
> +                        (rep_bandwidth_val ? strlen(rep_bandwidth_val) :
> 0)));
> +            max_url_size = max_url_size ? max_url_size : MAX_URL_SIZE;
>              seg->url = get_content_url(baseurl_nodes, 4,
>                                         max_url_size,
>                                         rep_id_val,
> --
> 2.39.5 (Apple Git-154)
>
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".