From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <ffmpeg-devel-bounces@ffmpeg.org> Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 6F3144D146 for <ffmpegdev@gitmailbox.com>; Wed, 16 Apr 2025 06:12:12 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 50A3D687ACF; Wed, 16 Apr 2025 09:12:07 +0300 (EEST) Received: from EUR05-VI1-obe.outbound.protection.outlook.com (mail-vi1eur05olkn2025.outbound.protection.outlook.com [40.92.90.25]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id F1AFF687ACF for <ffmpeg-devel@ffmpeg.org>; Wed, 16 Apr 2025 09:11:59 +0300 (EEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=YnpAX5jr1qRNb2KmDDos+z3ETptQBTJNXHWn6o3HXIMZ1jCXSLfF1FXU/YDNJCepVOVKarJi1e/w9VgIGXybTSBVDKbD575rZYnPM7eeN+LfyITejZbhb0hinOKAPnB0yl4xixBeUlp3nIgP+SAuybHpW7N5SG3omHrQXdq4yPaoBm37aUPd9pefzr6ODn4A5KZCX8BOWku9YUhwJG1P9TEPB8hL0RGJcp82Hkj3TgB6R/ybTWCZ+XlHPwN6ckytTIHWRcOnt5NWEqqQ3ctUefXGmXaOg6vXzdtjEYK3BCUypu/XO+bJIdh323xqzF+fNYReokeA0Y+Gvaxljajpug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=cCujUONLaC2TyaXE/y8cgg8JMQQ8GuPMrv8Csb4KDS0=; b=G6OvS+ZKJ/vE7Yoc5K37wrNeAaFZC1OWM56ZnWjUbZ2bUBzxg+8vC0MNR/fs3KCkFrcY+eGrtloEAdRjeBogma2mq1RZ+9ZRan8awm0GDJT57tgz7DQXrZyDpi+gatfAQUTMsZxwyECmLBQ51Ek0loDrzcQD2tPHe8F22XZFrL11SwhHJRuzBFSygi5YR+sCIHpOHk9LyHoBA0nCNb8NCY2ygSrKBptyql6vHcBZJ7yKfOdwchR0A9VvZYrkLyc5RXsdtGlgVQ22n/YhtIKQLDXthu2/2CUy+aTfEeuAzuQuk+9oQsioEWfzmD7Bb0y0/ro2kRiD5pCQ6gY/WsDVsg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cCujUONLaC2TyaXE/y8cgg8JMQQ8GuPMrv8Csb4KDS0=; b=ZhRWMWDz6yknoswYkMvTywqZC70k52RIaD65JtT6BX0dBKCRduOYP0TlTxwXwZ7X/KoAmw9Lxl6yLRoq3MpUrrINBXwpdVj37EQfV0S8/cnmT8aRYtmQV7vM0JqDbPI1NTUZhKCx/MMoXPpR83Op0pQpGdmYOfrPuBZCtYT2YqlIqPLWFnxGwStqmGzRZevZcii733r+c4pUeWSrcd3kqQFmgTN4bGzMhgUuFKNGGr64zI6eimqRZM4qNk/2UQcXaMGuW1dCcKwxDmYKPqJto6+hon1snzNdMIdqEzJl66T8eUxmSoJQtOxGtfZaHUJwYucprpDDuiHsljfukqE8Ww== Received: from GV1P250MB0737.EURP250.PROD.OUTLOOK.COM (2603:10a6:150:8e::17) by AS8P250MB0185.EURP250.PROD.OUTLOOK.COM (2603:10a6:20b:378::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8655.19; Wed, 16 Apr 2025 06:11:58 +0000 Received: from GV1P250MB0737.EURP250.PROD.OUTLOOK.COM ([fe80::d6a1:e3af:a5f1:b614]) by GV1P250MB0737.EURP250.PROD.OUTLOOK.COM ([fe80::d6a1:e3af:a5f1:b614%5]) with mapi id 15.20.8655.012; Wed, 16 Apr 2025 06:11:58 +0000 Message-ID: <GV1P250MB0737760708CE0C9F19CAF8D58FBD2@GV1P250MB0737.EURP250.PROD.OUTLOOK.COM> Date: Wed, 16 Apr 2025 08:11:57 +0200 User-Agent: Mozilla Thunderbird To: ffmpeg-devel@ffmpeg.org References: <20250411074808.33274-1-xiaohuanshu@gmail.com> <20250416060816.5065-1-xiaohuanshu@gmail.com> Content-Language: en-US From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> In-Reply-To: <20250416060816.5065-1-xiaohuanshu@gmail.com> X-ClientProxiedBy: FR2P281CA0095.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:9b::17) To GV1P250MB0737.EURP250.PROD.OUTLOOK.COM (2603:10a6:150:8e::17) X-Microsoft-Original-Message-ID: <b981453e-5ea5-490f-b550-65631ce18dbd@outlook.com> MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: GV1P250MB0737:EE_|AS8P250MB0185:EE_ X-MS-Office365-Filtering-Correlation-Id: 876846b5-ee05-4610-2067-08dd7cad984a X-MS-Exchange-SLBlob-MailProps: AZnQBsB9XmpI8tRyoOXaSUmOkLVCBKasQOdQe8hAGzk7ldJeDdBnLLhfOrQfuAXPC0Jujm1zqz2nCLhvzQAnujMe0JDrVuGJRyX/JKBNl67ysNaqXRG0p93fYd0gmDb+4gd3TCUhNldGyrSrTTVmnVtI1hnXfbFuidM1Uphe0jsZFgTl/EcscfLQYtxcVpxaso+TEBQi7uDfqZdZIwu2o1IzyfCzVfx1Wz4SL7Hzc2qvavdMuxPzaNX+Ww+he28f50axxU9iJnoB/gRXNDBZlddj7b/wzvMBSpKnIpJW/l5/6FRj1uaW3qCmaY/hGUjTxWmQ3cNsMdXDwqeXy8XP12a/sLRI45MUwOu+OOIa/Mf3Trffcz+pNWf7JGIunwfnB27+pMs6lhueQMyfwZC0ezCOK8wvShJ5O3AsBA/bSLGmqjFl3EhyEIW77IBX8hiehzd5qfRAN4PYJdOy2g287hGbuNLRn+tpaoIqoD18q2vmu+35zRV3v7MJC87prAi0UuD6eVc4Hv6HgmwnvjNVe5rNacjQlUDPByytib0MfOvZljxuGnzSVnicjeEblGBDtVGssfxWnSRoelKH76ZEBE9NDWO308GXMZNgzpKFL2knkWfFWZrvwJ/NxZEp//S/us5QEZtXhhy0Ue4fV4XpRqeBb2cR0Hb6GQI3UMxYr6JbxNsTegt+U6amNPpfbLTf7RzMnGB4HaX20GnnZctvmNkkm1/RmNhMclRrWgLyc2Z+eYWYZZ+CAjG9Ws11oD+D2ss00TTEESY= X-Microsoft-Antispam: BCL:0; ARA:14566002|6090799003|5072599009|19110799003|8060799006|15080799006|7092599003|461199028|3412199025|440099028|41001999003; X-Microsoft-Antispam-Message-Info: =?utf-8?B?N0szSnJ2MmswMEpHdThIZm4yd09FN2lkdlN4djZtUURvNXpmajVuZG9UVndh?= =?utf-8?B?S0oyLzhvN3BYOFYvcitxcjUyOHE0cXdyaWtZd0xNbWpGS2toY1ZZSWo3d0RR?= =?utf-8?B?L0JscW85UGdDTEs3Z1JGUi9CYW00dHA4N2VnV21GZUIzK1JOYjRLY2NXaTFW?= =?utf-8?B?MzdjT2lXTEJhUk9GTnZPcW1wY3RFTmZWNmQ0aGNHeUVETEp5VlhwNVJPWWZa?= =?utf-8?B?a3psckJ4WXpLSk5UcDNPczRpbFBHVmViOXhrbkh5TTZidUJ2WEpTV21TSWlW?= =?utf-8?B?WnBSWFd1cVpkVkloajRCKzBrM0dIMk1UcXQxK2pncnpocXpxalRSWjFyeWVp?= =?utf-8?B?cS9tenhOeU5NQnZ5MFpsVHF2M2V2dDFHbFI4Ti9IZTFOTU8zcnFyeDN1SnRq?= =?utf-8?B?N2V0TXpaUTZkZzhQUmkzeFQyeG1FZEE0Mzl1QWJ0VFJxZjZJZ1hnYXBOWHI5?= =?utf-8?B?TDNWRmVocnZYRGpxNW9DYVN5bzI5d2hLTEl2ZUtvTWR0cm44aFdTRmlKczk5?= =?utf-8?B?SnorWFd2WWgydUpQNE9YZ0t5NHoyQ3VuVkovWFFHdU1vUHRVN2dqT3lBUlpQ?= =?utf-8?B?NFh0bnF3ZDM1bWNwVk84SHVVSzZaOWZQSTNHS25iNXBjc08vY1JJUVBVZk9z?= =?utf-8?B?RzlxZWNxQVp2UlQraG1rWHBWdVJHVGFGRVdMenR4Q29IV0RjNVJJY0VOVG00?= =?utf-8?B?OUw4N3hPVmpkeW5jRXVjT1ozb3dmS3VIa3VsRWFpREhJY1RnT1I2c252dFZm?= =?utf-8?B?V1NJbWU3N0JjUlJic2VrMVl4bEgyc2NoTlg2Qno3NVIxWlpwS1NOZVhHNG1N?= =?utf-8?B?T2FWN29RVmhzREVraFUvcVczK2dNckZGbDMxQVJhTHN4TUhqc25CUGlHUjZK?= =?utf-8?B?TGlXZ3hWdlFwb3ZvYW1UMXR4dUFhc2xRaEFNWktxR3pUcjRqNElsdC9wQ1JO?= =?utf-8?B?SlJETzVMRCtHMC9wNndaZ3l1WDFMdnp3dXE0Y1NjbGJoQ05ub0RaZllpUGhF?= =?utf-8?B?czU5MzArVVFFc0l4bWZ2emdoSlk0SXRXcDNtbWFvbUV6NE83K2xKOW9QTmNv?= =?utf-8?B?aUZMemxEMlFZN25SS0U0eUZtM3BoT3dPZ1NqZ1BJTkN4WDJWUzN6dkZQS2JZ?= =?utf-8?B?MThub0l1MllEUHhsTWZOSmpKSm82TUx5eFNtaVlSTXNNSnJNSjRBalBaVEZp?= =?utf-8?B?azhlaWxxbzFWd0xhTGxPcVRvOWZVTkNVUnRvcSt6UlM5bnlwV2lsK1VseXRt?= =?utf-8?B?NGZiVnZ2UEJwZHBJZmpKSGFET0NFUFJnbSs4aVl6ZXRJSzJyazRveElBMUly?= =?utf-8?B?OU4yNENlM0xCanNSbVNaVFVjSS9HWC9jVDQwM1pUUFlmSDZlSHBQSUVTOGxo?= =?utf-8?B?MXEwWERPcW9hRjhMVDBzR3ZWL0pabDZ2VmcrR2l1WGt6ZjhQYUZHSk9ETWI4?= =?utf-8?B?WjV6cEhyMGEzTUpQdmxOOHFCNDF1OFNTS3FhRnhEd3JzZXg2QmNiUlp4KzhU?= =?utf-8?B?Y0JtOG9hZGlHSzExZTh5RUZFUkg4ZFZHZkZkTkk1eGl3cFRSNHN1SHlaMzBI?= =?utf-8?Q?WXnqpr47bFo/6haZFC06VLhyw=3D?= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?bGJWNmdDeEp2RnpWdjUzQTVQcGhoSHg1ZFdPTFFuQmdjZ3MxeEpkandYL3ZN?= =?utf-8?B?Q1drSURmTEhUVmJFMmRxbEUzSUVsQUhQNnNtUDZvL2ZTc2Q0bktnVkZCZkNB?= =?utf-8?B?bWUwbDVTYTlseWZaODNzanN5dnRmS0FjRHlqTStRdzR3TFpVa0VZQmJ4S2Fa?= =?utf-8?B?L3FmLzM3VGFWNFFRLzRxb25KUXBucnhwV2lRSHZnQmM5SGpneFhXWkhyaUxC?= =?utf-8?B?dGd1em5QV2pHUFk0bGYvVklwVEFoRUUxbGlIK2Jibkg1RnhvZEwvTlFTWmJa?= =?utf-8?B?NVlVZHNpbW9ncTZXSURHbUoycTZzaW5pZTRKRnNGMEw4ZlFaVC82ZVFFZVI2?= =?utf-8?B?RVV1Q09wYVpZdC9MMEQ2Q3N6N1VDU0tSY0hhSGlHR0lzcXlZeTV6QlNtM1VV?= =?utf-8?B?TXpzZjlNcmNKSG1ZdFhLRnRyRjhIcmw4aGFnL0F0T0lQblhpaU05K2p0MHQz?= =?utf-8?B?Y0dnL0ZwOXJQWmxyaDd1NEFvMFRkZ0dkQ0czY1FXM0lKU1Z3NXdtaWxHQ3BY?= =?utf-8?B?UXFjSGZ2Qm1FMkYvK2tSWVBiRzY2cW5pZkZDVjYxWjRySXRZNndBSUJiL1pp?= =?utf-8?B?SFE0MUpnZWtMNnhIekFaNkZGcXZEVVY0eGhCY0lNL3lUVlcxZENtQ0pIVGx1?= =?utf-8?B?Y0RJdERiekp1a3R5ZUFpV0VEWjF1WWZCdlFBTzQxaTBXRkdTNGN0NzRYL2Nh?= =?utf-8?B?NEVVMmVUUXBVQ0VjNzl2Y3NmdUd1L3pZYms0Rlp4OER4Z3B6MnRFanNUL3o5?= =?utf-8?B?Rk5HaWNDejBOcHBKMWd5ekFWclN3c2tuejZvWG9NeHpQS2UzKzF1dkVLVXZN?= =?utf-8?B?US9GbFRVbzRjRC9tRHJyRWU2UkFFUDZ5b1ZHSUFGUXdUUDRlNlJWbUkvZ2Nt?= =?utf-8?B?MUVaQjBwanB0cjZxNHE2TkJBQnF3dHlYUDBlVEVSQWV4NS9MQW4waXJUbUFQ?= =?utf-8?B?RUI1SlY4TVVxSktyZmJjSEMrN3ZmR3F6SkFBREdFM1VobG4xdUFHM1dJbGhr?= =?utf-8?B?aGVZcUdjQ1UxVlRjd3dHWHNpUlFqZWxDYkNpUVFYVUlrS1NOZ25hdWc4ditp?= =?utf-8?B?eVRjMThaSmpEY3pxcU9nWG5iUzRGaEJTb2hNb3RrY2VpMzRRRlp1R3hFSVQy?= =?utf-8?B?UmgyempHajV1K2xHN09DamRWQmVINHFycnpKR0ZZZzlOMVdxc0VvWW9kVFVR?= =?utf-8?B?WDJmOHNyUk5RUmI1ZFlQT1EvWHdtcS93OFdFcjJPUUE2TjB1OTRVUzdDYWY5?= =?utf-8?B?bUszb2ZVYkRTcHpRZ2RQQzZJaXFKY3lQU2JBaysyVUxLWUNGY3JXRWI5Zytm?= =?utf-8?B?VGloNDY0STVmWWxTZmJCcy9KNDJNcjBLaG04M2NLYTJFc0F6TnduSENiOThK?= =?utf-8?B?ZENhMG9lV3VnaHVpRTBpQUJLT2lIQ2lVMUFZY3hqSnE5clpWeFRvcms5VXJh?= =?utf-8?B?aXB3SFBxOFBDWW95eEZmaFRHU2s1Y2pxRURUMCszMWQwNkVsYTR3R0Y0MU5i?= =?utf-8?B?U1hGT2hEMVpiRkNZNURlck0wUlEyWHJOYllUUWg3N0tidU5SeW94QTh5eG12?= =?utf-8?B?VU0xTUxkemxxemMrR0MrZFFIWC8zT3B4MmlWb0VuMWZFdXhyTVhjT0k4c0hS?= =?utf-8?B?Z1pnZzJ5eDZabFpCZGljalV5MnM5eVFrbHRtR1RwNmpMM3hRSDd0UForcU5h?= =?utf-8?B?aTd4OXh0SjNDYmxOclNxUEFVTE5zRjFHLzMxTlNnV3BYYXhmUm5CRSs2NlRP?= =?utf-8?Q?beWWpuC7MRVmIZ3/Vkk0dVnzED0VjtYQ8VmHjOW?= X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 876846b5-ee05-4610-2067-08dd7cad984a X-MS-Exchange-CrossTenant-AuthSource: GV1P250MB0737.EURP250.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Apr 2025 06:11:58.5021 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P250MB0185 Subject: Re: [FFmpeg-devel] [PATCH v2] libavformat/dashdec: Fix buffer overflow in segment URL resolution X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches <ffmpeg-devel.ffmpeg.org> List-Unsubscribe: <https://ffmpeg.org/mailman/options/ffmpeg-devel>, <mailto:ffmpeg-devel-request@ffmpeg.org?subject=unsubscribe> List-Archive: <https://ffmpeg.org/pipermail/ffmpeg-devel> List-Post: <mailto:ffmpeg-devel@ffmpeg.org> List-Help: <mailto:ffmpeg-devel-request@ffmpeg.org?subject=help> List-Subscribe: <https://ffmpeg.org/mailman/listinfo/ffmpeg-devel>, <mailto:ffmpeg-devel-request@ffmpeg.org?subject=subscribe> Reply-To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org> Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" <ffmpeg-devel-bounces@ffmpeg.org> Archived-At: <https://master.gitmailbox.com/ffmpegdev/GV1P250MB0737760708CE0C9F19CAF8D58FBD2@GV1P250MB0737.EURP250.PROD.OUTLOOK.COM/> List-Archive: <https://master.gitmailbox.com/ffmpegdev/> List-Post: <mailto:ffmpegdev@gitmailbox.com> xiaohuanshu@gmail.com: > From: xiaohuanshu <xiaohuanshu@gmail.com> > > Problem: > The max_url_size calculation for DASH segment URLs only considered the base URL > length, leading to buffer overflow when the segment's sourceURL exceeded the > pre-allocated buffer. This triggered the log error: > "DASH request for url 'invalid:truncated'". > > Reproduce: > 1. A test sample "long-sourceurl-sample.mpd" (deliberately designed with a long > sourceURL) was uploaded to VideoLAN's repository. > 2. Reproduce with short base path: > ffmpeg -i /tmp/short_path/long-sourceurl-sample.mpd > -> Triggers "invalid:truncated" error > 3. With artificially lengthened base path (e.g. /aaa/../bbb/../...): > ffmpeg -i /long/../path/../with/../many/../segments/long-sourceurl-sample.mpd > -> URL resolves correctly (though HTTP fetch fails due to fake URL) > > Fix: > Recalculate max_url_size by considering both base URL and sourceURL lengths, > ensuring sufficient buffer allocation during URL concatenation. > > V2: > 1. no need to determine whether initialization_val is null. > 2. fix the incorrect variable name. > > Signed-off-by: xiaohuanshu <xiaohuanshu@gmail.com> > --- > libavformat/dashdec.c | 14 +++++++++++++- > 1 file changed, 13 insertions(+), 1 deletion(-) > > diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c > index c3f3d7f3f8..a574c91932 100644 > --- a/libavformat/dashdec.c > +++ b/libavformat/dashdec.c > @@ -606,7 +606,7 @@ static int parse_manifest_segmenturlnode(AVFormatContext *s, struct representati > char *initialization_val = NULL; > char *media_val = NULL; > char *range_val = NULL; > - int max_url_size = c ? c->max_url_size: MAX_URL_SIZE; > + int max_url_size = 0; This should use way smaller scope. > int err; > > if (!av_strcasecmp(fragmenturl_node->name, "Initialization")) { > @@ -620,6 +620,12 @@ static int parse_manifest_segmenturlnode(AVFormatContext *s, struct representati > xmlFree(initialization_val); > return AVERROR(ENOMEM); > } > + max_url_size = FFMAX( > + c ? c->max_url_size : 0, > + aligned(strlen(initialization_val) + > + (rep_id_val ? strlen(rep_id_val) : 0) + > + (rep_bandwidth_val ? strlen(rep_bandwidth_val) : 0))); > + max_url_size = max_url_size ? max_url_size : MAX_URL_SIZE; > rep->init_section->url = get_content_url(baseurl_nodes, 4, > max_url_size, > rep_id_val, > @@ -641,6 +647,11 @@ static int parse_manifest_segmenturlnode(AVFormatContext *s, struct representati > xmlFree(media_val); > return AVERROR(ENOMEM); > } > + max_url_size = FFMAX( > + c ? c->max_url_size : 0, > + aligned(strlen(media_val) + (rep_id_val ? strlen(rep_id_val) : 0) + > + (rep_bandwidth_val ? strlen(rep_bandwidth_val) : 0))); > + max_url_size = max_url_size ? max_url_size : MAX_URL_SIZE; > seg->url = get_content_url(baseurl_nodes, 4, > max_url_size, > rep_id_val, > @@ -2369,3 +2380,4 @@ const FFInputFormat ff_dash_demuxer = { > .read_close = dash_close, > .read_seek = dash_read_seek, > }; > + Stray change _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".