From ac2852d7958622322c69d68212d96fe41a595001 Mon Sep 17 00:00:00 2001 From: Andreas Rheinhardt Date: Mon, 7 Sep 2020 20:49:02 +0200 Subject: avformat/dashdec, hls: Update correct pointer to AVDictionary open_url() in the DASH as well in the hls demuxer share a common bug: They modify an AVDictionary (i.e. set a new entry) given to them as AVDictionary *, yet if this new entry leads to reallocation and relocation of the AVDictionary, the caller's pointer will become dangling, leading to use-after-frees. So pass an AVDictionary **. (With the current implementation of AVDictionary the above can only happen if the AVDictionary was empty initially (in which case the new AVDictionary leaks); furthermore if the I/O is ordinary (i.e. opened by avio_open2() or ffio_open_whitelist()), the dict is never empty (it contains an rw_timeout entry from save_avio_options()). So this issue could only happen if the caller sets a nondefault io_open callback, but no AVIOContext (the AVFMT_FLAG_CUSTOM_IO flag won't be set in this case). In case of the HLS demuxer, it was also necessary that setting the "seekable" entry failed. Yet one should simply not rely on internals of the AVDict API.) Reviewed-by: Steven Liu Signed-off-by: Andreas Rheinhardt --- libavformat/hls.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'libavformat/hls.c') diff --git a/libavformat/hls.c b/libavformat/hls.c index 3ab07f1b3f..f33ff3f645 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -617,7 +617,7 @@ static int open_url_keepalive(AVFormatContext *s, AVIOContext **pb, } static int open_url(AVFormatContext *s, AVIOContext **pb, const char *url, - AVDictionary *opts, AVDictionary *opts2, int *is_http_out) + AVDictionary **opts, AVDictionary *opts2, int *is_http_out) { HLSContext *c = s->priv_data; AVDictionary *tmp = NULL; @@ -664,7 +664,7 @@ static int open_url(AVFormatContext *s, AVIOContext **pb, const char *url, else if (strcmp(proto_name, "file") || !strncmp(url, "file,", 5)) return AVERROR_INVALIDDATA; - av_dict_copy(&tmp, opts, 0); + av_dict_copy(&tmp, *opts, 0); av_dict_copy(&tmp, opts2, 0); if (is_http && c->http_persistent && *pb) { @@ -690,7 +690,7 @@ static int open_url(AVFormatContext *s, AVIOContext **pb, const char *url, av_opt_get(*pb, "cookies", AV_OPT_SEARCH_CHILDREN, (uint8_t**)&new_cookies); if (new_cookies) - av_dict_set(&opts, "cookies", new_cookies, AV_DICT_DONT_STRDUP_VAL); + av_dict_set(opts, "cookies", new_cookies, AV_DICT_DONT_STRDUP_VAL); } av_dict_free(&tmp); @@ -1231,12 +1231,12 @@ static int open_input(HLSContext *c, struct playlist *pls, struct segment *seg, seg->url, seg->url_offset, pls->index); if (seg->key_type == KEY_NONE) { - ret = open_url(pls->parent, in, seg->url, c->avio_opts, opts, &is_http); + ret = open_url(pls->parent, in, seg->url, &c->avio_opts, opts, &is_http); } else if (seg->key_type == KEY_AES_128) { char iv[33], key[33], url[MAX_URL_SIZE]; if (strcmp(seg->key, pls->key_url)) { AVIOContext *pb = NULL; - if (open_url(pls->parent, &pb, seg->key, c->avio_opts, opts, NULL) == 0) { + if (open_url(pls->parent, &pb, seg->key, &c->avio_opts, opts, NULL) == 0) { ret = avio_read(pb, pls->key, sizeof(pls->key)); if (ret != sizeof(pls->key)) { av_log(pls->parent, AV_LOG_ERROR, "Unable to read key file %s\n", @@ -1260,7 +1260,7 @@ static int open_input(HLSContext *c, struct playlist *pls, struct segment *seg, av_dict_set(&opts, "key", key, 0); av_dict_set(&opts, "iv", iv, 0); - ret = open_url(pls->parent, in, url, c->avio_opts, opts, &is_http); + ret = open_url(pls->parent, in, url, &c->avio_opts, opts, &is_http); if (ret < 0) { goto cleanup; } -- cgit v1.2.3