mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2024-09-19 12:56:40 +00:00
avformat/avio: Limit url option parsing to the documented cases
This feature is not know much or used much AFAIK, and it might be helpfull in
exploits.
No specific case is known where it can be used in an exploit though
subsequent commits depend on this commit though
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 984d58a344
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
7ee0b1937a
commit
30463a0c99
@ -155,9 +155,16 @@ static int url_alloc_for_protocol(URLContext **puc, struct URLProtocol *up,
|
||||
char sep= *++p;
|
||||
char *key, *val;
|
||||
p++;
|
||||
|
||||
if (strcmp(up->name, "subfile"))
|
||||
ret = AVERROR(EINVAL);
|
||||
|
||||
while(ret >= 0 && (key= strchr(p, sep)) && p<key && (val = strchr(key+1, sep))){
|
||||
*val= *key= 0;
|
||||
ret= av_opt_set(uc->priv_data, p, key+1, 0);
|
||||
if (strcmp(p, "start") && strcmp(p, "end")) {
|
||||
ret = AVERROR_OPTION_NOT_FOUND;
|
||||
} else
|
||||
ret= av_opt_set(uc->priv_data, p, key+1, 0);
|
||||
if (ret == AVERROR_OPTION_NOT_FOUND)
|
||||
av_log(uc, AV_LOG_ERROR, "Key '%s' not found.\n", p);
|
||||
*val= *key= sep;
|
||||
@ -222,7 +229,7 @@ static struct URLProtocol *url_find_protocol(const char *filename)
|
||||
size_t proto_len = strspn(filename, URL_SCHEME_CHARS);
|
||||
|
||||
if (filename[proto_len] != ':' &&
|
||||
(filename[proto_len] != ',' || !strchr(filename + proto_len + 1, ':')) ||
|
||||
(strncmp(filename, "subfile,", 8) || !strchr(filename + proto_len + 1, ':')) ||
|
||||
is_dos_path(filename))
|
||||
strcpy(proto_str, "file");
|
||||
else
|
||||
|
Loading…
Reference in New Issue
Block a user