summaryrefslogtreecommitdiff
path: root/libavformat/hls.c
Commit message (Collapse)AuthorAge
* avformat/hls: Check local file extensionsMichael Niedermayer2017-06-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reduces the attack surface of local file-system information leaking. It prevents the existing exploit leading to an information leak. As well as similar hypothetical attacks. Leaks of information from files and symlinks ending in common multimedia extensions are still possible. But files with sensitive information like private keys and passwords generally do not use common multimedia filename extensions. It does not stop leaks via remote addresses in the LAN. The existing exploit depends on a specific decoder as well. It does appear though that the exploit should be possible with any decoder. The problem is that as long as sensitive information gets into the decoder, the output of the decoder becomes sensitive as well. The only obvious solution is to prevent access to sensitive information. Or to disable hls or possibly some of its feature. More complex solutions like checking the path to limit access to only subdirectories of the hls path may work as an alternative. But such solutions are fragile and tricky to implement portably and would not stop every possible attack nor would they work with all valid hls files. Developers have expressed their dislike / objected to disabling hls by default as well as disabling hls with local files. There also where objections against restricting remote url file extensions. This here is a less robust but also lower inconvenience solution. It can be applied stand alone or together with other solutions. limiting the check to local files was suggested by nevcairiel This recommits the security fix without the author name joke which was originally requested by Nicolas. Found-by: Emil Lerner and Pavel Cheremushkin Reported-by: Thierry Foucu <tfoucu@google.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* Revert "avformat/hls: Check local file extensions"Michael Niedermayer2017-06-05
| | | | | Requested-by: Paul B Mahol <onemda@gmail.com> This reverts commit caf7d6178a4d5f24c915da48410a9790b21703aa.
* avformat/hls: Check local file extensionsSysiphus2017-06-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reduces the attack surface of local file-system information leaking. It prevents the existing exploit leading to an information leak. As well as similar hypothetical attacks. Leaks of information from files and symlinks ending in common multimedia extensions are still possible. But files with sensitive information like private keys and passwords generally do not use common multimedia filename extensions. It does not stop leaks via remote addresses in the LAN. The existing exploit depends on a specific decoder as well. It does appear though that the exploit should be possible with any decoder. The problem is that as long as sensitive information gets into the decoder, the output of the decoder becomes sensitive as well. The only obvious solution is to prevent access to sensitive information. Or to disable hls or possibly some of its feature. More complex solutions like checking the path to limit access to only subdirectories of the hls path may work as an alternative. But such solutions are fragile and tricky to implement portably and would not stop every possible attack nor would they work with all valid hls files. Developers have expressed their dislike / objected to disabling hls by default as well as disabling hls with local files. There also where objections against restricting remote url file extensions. This here is a less robust but also lower inconvenience solution. It can be applied stand alone or together with other solutions. limiting the check to local files was suggested by nevcairiel Found-by: Emil Lerner and Pavel Cheremushkin Reported-by: Thierry Foucu <tfoucu@google.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* libavformat/hls: Observe Set-Cookie headersMicah Galizia2017-05-29
| | | | | Signed-off-by: Micah Galizia <micahgalizia@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* lavf/hls: do not transfer custom IO flagClément Bœsch2017-05-22
| | | | See 0dcac9c3f0f8f32009098edb704fac4b08bac951
* hls: consistent use of user_agentJan Berkel2017-03-23
| | | | | | | This came up while debugging a problem with mpv: https://github.com/mpv-player/mpv/issues/4155 Signed-off-by: wm4 <nfxjfg@googlemail.com>
* hls: pass AVFormatContext flags to sub demuxerwm42017-03-09
|
* hls: fix leaking avio_opts on hls_read_header errorAndreas Cadhalpun2016-11-07
| | | | | | | Use the hls_close function to reduce code duplication. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
* hls: move hls_close above hls_read_headerAndreas Cadhalpun2016-11-07
| | | | | | | This is needed for the following commit. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
* avformat/hls: Add missing error check for avcodec_parameters_copy()Anssi Hannula2016-11-07
| | | | Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
* avformat/hls: Fix probing mpegts audio streams that use probingAnssi Hannula2016-11-07
| | | | | | | | | | | | | Commit 04964ac311abe670f ("avformat/hls: Fix missing streams in some cases with MPEG TS") caused a regression where subdemuxer streams that use probing (e.g. dts/eac3/mp2 in mpegts) no longer get probed properly. This is because the codec parameters from the subdemuxer stream, once probed, are not passed on to the main stream. Fix that by updating the codec parameters if the codec id changes. Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
* avformat/hls: Factor copying stream info to a separate functionAnssi Hannula2016-11-07
| | | | Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
* avformat/hls: Fix handling of EXT-X-BYTERANGE streams over 2GBAnssi Hannula2016-09-24
| | | | | | | | Replace uses of atoi() with strtoll() when trying to read values into int64_t variables. Fixes Kodi trac #16926: http://trac.kodi.tv/ticket/16926
* avformat/hls: Fix missing streams in some cases with MPEG TSAnssi Hannula2016-07-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | HLS demuxer calls the subdemuxer avformat_find_stream_info() while overriding the subdemuxer AVFMTCTX_NOHEADER flag by clearing it. However, this prevents some streams in some MPEG TS streams from being detected properly. Simply removing the clearing of the flag would cause the inner avformat_find_stream_info() call to take longer in some cases, without a way to control it. To fix the issue, do not clear the flag but propagate it to HLS demuxer. To avoid the above-mentioned mandatory delay, the call to avformat_find_stream_info() is dropped except in the HLS ID3 timestamped case. The HLS demuxer user should be calling avformat_find_stream_info() on the HLS demuxer if it wants to find the stream info. The main streams are now created dynamically after read_header time if the subdemuxer uses AVFMTCTX_NOHEADER (mpegts). Subdemuxer avformat_find_stream_info() is still called for the HLS ID3 timestamped case as the HLS demuxer needs to know the packet durations to properly interleave ID3 timestamped streams with MPEG TS streams on sub-segment level. Fixes ticket #4930.
* avformat/hls: Move stream propagation to a separate functionAnssi Hannula2016-07-28
| | | | | | | Creation of main demuxer streams from subdemuxer streams is moved to update_streams_from_subdemuxer() which can be called repeatedly. There should be no functional changes.
* avformat/hls: Use an array instead of stream offset for stream mappingAnssi Hannula2016-07-28
| | | | | This will be useful when the amount of streams per subdemuxer is not known at hls_read_header time in a following commit.
* avformat/hls: Sync starting segment across variants on live streamsAnssi Hannula2016-07-28
| | | | | This will avoid a large time difference between variants in the most common case.
* avformat/hls: Fix regression with ranged media segmentsAnssi Hannula2016-07-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 81306fd4bdf ("hls: eliminate ffurl_* usage", merged in d0fc5de3a6) changed the hls demuxer to use AVIOContext instead of URLContext for its HTTP requests. HLS demuxer uses the "offset" option of the http demuxer, requesting the initial file offset for the I/O (http URLProtocol uses the "Range:" HTTP header to try to accommodate that). However, the code in libavformat/aviobuf.c seems to be doing its own accounting for the current file offset (AVIOContext.pos), with the assumption that the initial offset is always zero. HLS demuxer does an explicit seek after open_url to account for cases where the "offset" was not effective (due to the URL being a local file or the HTTP server not obeying it), which should be a no-op in case the file offset is already at that position. However, since aviobuf.c code thinks the starting offset is 0, this doesn't work properly. This breaks retrieval of ranged media segments. To fix the regression, just drop the seek call from the HLS demuxer when the HTTP(S) protocol is used.
* Merge commit '5afb94c817abffad030c6b94d7003dca8aace3d5'Clément Bœsch2016-06-21
|\ | | | | | | | | | | | | * commit '5afb94c817abffad030c6b94d7003dca8aace3d5': Mark read-only tables as static Merged-by: Clément Bœsch <u@pkh.me>
| * Mark read-only tables as staticDiego Biurrun2016-05-05
| |
* | Merge commit '9200514ad8717c63f82101dc394f4378854325bf'Derek Buitenhuis2016-04-10
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * commit '9200514ad8717c63f82101dc394f4378854325bf': lavf: replace AVStream.codec with AVStream.codecpar This has been a HUGE effort from: - Derek Buitenhuis <derek.buitenhuis@gmail.com> - Hendrik Leppkes <h.leppkes@gmail.com> - wm4 <nfxjfg@googlemail.com> - Clément Bœsch <clement@stupeflix.com> - James Almer <jamrial@gmail.com> - Michael Niedermayer <michael@niedermayer.cc> - Rostislav Pehlivanov <atomnuker@gmail.com> Merged-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
| * lavf: replace AVStream.codec with AVStream.codecparAnton Khirnov2016-02-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, AVStream contains an embedded AVCodecContext instance, which is used by demuxers to export stream parameters to the caller and by muxers to receive stream parameters from the caller. It is also used internally as the codec context that is passed to parsers. In addition, it is also widely used by the callers as the decoding (when demuxer) or encoding (when muxing) context, though this has been officially discouraged since Libav 11. There are multiple important problems with this approach: - the fields in AVCodecContext are in general one of * stream parameters * codec options * codec state However, it's not clear which ones are which. It is consequently unclear which fields are a demuxer allowed to set or a muxer allowed to read. This leads to erratic behaviour depending on whether decoding or encoding is being performed or not (and whether it uses the AVStream embedded codec context). - various synchronization issues arising from the fact that the same context is used by several different APIs (muxers/demuxers, parsers, bitstream filters and encoders/decoders) simultaneously, with there being no clear rules for who can modify what and the different processes being typically delayed with respect to each other. - avformat_find_stream_info() making it necessary to support opening and closing a single codec context multiple times, thus complicating the semantics of freeing various allocated objects in the codec context. Those problems are resolved by replacing the AVStream embedded codec context with a newly added AVCodecParameters instance, which stores only the stream parameters exported by the demuxers or read by the muxers.
* | hls: handle crypto in the protocol checksHendrik Leppkes2016-03-16
| | | | | | | | Fixes issue 5248
* | hls: read protocol options through the AVIOContextHendrik Leppkes2016-03-16
| | | | | | | | | | | | | | | | | | | | This reverts commit 9f9ed79d4cb40e5d9093899f8a79086ff23da844. The hlsopts member was never set anywhere and always NULL, furthermore the HLS demuxer needs to retrieve the proper options from the underlying http protocol (cookies, user-agent, etc), so a dummy context won't help. Instead, use the AVIOContext directly to access the options.
* | avformat: Add a protocol blacklisting APIDerek Buitenhuis2016-03-04
| | | | | | | | Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
* | hls: Add and use a memebr of AVIOInternal rather than abuse opaqueDerek Buitenhuis2016-02-29
| | | | | | | | Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
* | Merge commit '225e84e74544062706c0159ec0737b0e1d40915f'Derek Buitenhuis2016-02-29
|\| | | | | | | | | | | | | * commit '225e84e74544062706c0159ec0737b0e1d40915f': hls: disallow opening nested files in child demuxers Merged-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
| * hls: disallow opening nested files in child demuxersAnton Khirnov2016-02-22
| |
* | avformat/hls: fix potential integer overflowMichael Niedermayer2016-02-16
| | | | | | | | | | | | This is not a regression Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | Merge commit '81306fd4bdeb5c17d4db771e4fec684773b5790f'Derek Buitenhuis2016-02-16
|\| | | | | | | | | | | | | * commit '81306fd4bdeb5c17d4db771e4fec684773b5790f': hls: eliminate ffurl_* usage Merged-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
| * hls: eliminate ffurl_* usageAnton Khirnov2016-01-24
| | | | | | | | | | Now all IO should go through the IO callbacks and be interceptable by the caller.
* | Merge commit '9f61abc8111c7c43f49ca012e957a108b9cc7610'Derek Buitenhuis2016-02-10
|\| | | | | | | | | | | | | | | | | This also deprecates our old duplicated callbacks. * commit '9f61abc8111c7c43f49ca012e957a108b9cc7610': lavf: allow custom IO for all files Merged-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
| * lavf: allow custom IO for all filesAnton Khirnov2016-01-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Some (de)muxers open additional files beyond the main IO context. Currently, they call avio_open() directly, which prevents the caller from using custom IO for such streams. This commit adds callbacks to AVFormatContext that default to avio_open2()/avio_close(), but can be overridden by the caller. All muxers and demuxers using AVIO are switched to using those callbacks instead of calling avio_open()/avio_close() directly. (de)muxers that use the URLProtocol layer directly instead of AVIO remain unconverted for now. This should be fixed in later commits.
* | Update demuxers and protocols for protocol whitelist supportMichael Niedermayer2016-02-02
| | | | | | | | | | Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | Revert "avformat/hls: Require the file extension to be m3u / m3u8 for ↵Michael Niedermayer2016-02-01
| | | | | | | | | | | | | | | | | | | | | | probing to succeed" This can cause problems with urls that have arguments after the filename This reverts commit b0c57206d583517a5ea35dd7f365f8260d9106f2. Reviewed-by: wm4 <nfxjfg@googlemail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avformat/hls: Check that filename is not "" in probe before checking its ↵Michael Niedermayer2016-01-25
| | | | | | | | | | | | | | | | | | extension Possibly the check as a whole causes more problems than it helps, if so dont hesitate to remove it Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avformat/hls: Require the file extension to be m3u / m3u8 for probing to succeedMichael Niedermayer2016-01-19
| | | | | | | | | | | | If the filename isnt set by the user application then the code behaves like before Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avformat/hls: Even stricter URL checksMichael Niedermayer2016-01-15
| | | | | | | | | | | | This fixes a null pointer dereference at least Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avformat/hls: More strict url checksMichael Niedermayer2016-01-15
| | | | | | | | | | | | No case is known where these are needed Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avformat/hls: forbid all protocols except http(s) & fileMaxim Andreev2016-01-14
| | | | | | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avformat/hls: Added http_proxy supportJoel Holdsworth2015-12-27
| | | | | | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avformat/hls: Remember to free HLSContext::headersJoel Holdsworth2015-12-27
| | | | | | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avformat: Add av_program_add_stream_index()Michael Niedermayer2015-12-11
| | | | | | | | | | | | This will be used by the subsequent commit(s) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | Merge commit 'ce70f28a1732c74a9cd7fec2d56178750bd6e457'Hendrik Leppkes2015-10-27
|\| | | | | | | | | | | | | * commit 'ce70f28a1732c74a9cd7fec2d56178750bd6e457': avpacket: Replace av_free_packet with av_packet_unref Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
| * avpacket: Replace av_free_packet with av_packet_unrefLuca Barbato2015-10-26
| | | | | | | | | | | | | | `av_packet_unref` matches the AVFrame ref-counted API and can be used as a drop in replacement. Deprecate `av_free_packet`.
| * hls: Check av_opt_set_dict return value as wellLuca Barbato2015-10-01
| | | | | | | | Bug-Id: CID 1320426
* | avformat/hls: add support for EXT-X-MAPAnssi Hannula2015-10-15
| | | | | | | | | | | | | | | | | | Without EXT-X-MAP support we miss the first bytes of some streams. These streams worked by luck before byte-ranged segment support was added in da7759b3579de3e98deb1ac58e642b861280ba54 Fixes ticket #4797.
* | avformat/hls: fix segment selection regression on track changes of live streamsAnssi Hannula2015-10-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit ad701326b43078b90 ("avformat/hls: open playlists immediately when AVDISCARD_ALL is dropped") inadvertently caused first_packet to never be cleared, causing select_cur_seq_no() to not use the specific code for live streams. In practice this means that when the user selects a different audio track during live stream (i.e. non-VOD) playback, there may be some additional delay as the code might select an incorrect segment at first, and we have to wait for video to catch audio (if too late segment was selected) or to download more following audio segments (if too early segment was selected). Fix that by restoring the zeroing of first_packet.
* | lavf/hls: don't convert NULL options to empty strings; fixes HTTP CRLF warningsRodger Combs2015-10-09
| |
* | lavf/hls: allow subtitles to be read despite incomplete handlingRodger Combs2015-10-03
| | | | | | | | | | | | | | This will give incorrect results in some cases due to not parsing segments separately, so it currently requires -strict experimental. Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-23 19:43:33 +0000