[FFmpeg-devel] [PATCH 2/2] avformat/avio: Remove url options parsing

[Michael Niedermayer]

From: Michael Niedermayer <michael at niedermayer.cc>

This feature is not know much or used much AFAIK, and it might be helpfull in
exploits.
No specific case is known where it can be used in an exploit though

Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavformat/avio.c |   30 +-----------------------------
 1 file changed, 1 insertion(+), 29 deletions(-)

diff --git a/libavformat/avio.c b/libavformat/avio.c
index 21713d9..21655d8 100644
--- a/libavformat/avio.c
+++ b/libavformat/avio.c
@@ -146,33 +146,8 @@ static int url_alloc_for_protocol(URLContext **puc, struct URLProtocol *up,
             goto fail;
         }
         if (up->priv_data_class) {
-            int proto_len= strlen(up->name);
-            char *start = strchr(uc->filename, ',');
             *(const AVClass **)uc->priv_data = up->priv_data_class;
             av_opt_set_defaults(uc->priv_data);
-            if(!strncmp(up->name, uc->filename, proto_len) && uc->filename + proto_len == start){
-                int ret= 0;
-                char *p= start;
-                char sep= *++p;
-                char *key, *val;
-                p++;
-                while(ret >= 0 && (key= strchr(p, sep)) && p<key && (val = strchr(key+1, sep))){
-                    *val= *key= 0;
-                    ret= av_opt_set(uc->priv_data, p, key+1, 0);
-                    if (ret == AVERROR_OPTION_NOT_FOUND)
-                        av_log(uc, AV_LOG_ERROR, "Key '%s' not found.\n", p);
-                    *val= *key= sep;
-                    p= val+1;
-                }
-                if(ret<0 || p!=key){
-                    av_log(uc, AV_LOG_ERROR, "Error parsing options string %s\n", start);
-                    av_freep(&uc->priv_data);
-                    av_freep(&uc);
-                    err = AVERROR(EINVAL);
-                    goto fail;
-                }
-                memmove(start, key+1, strlen(key));
-            }
         }
     }
     if (int_cb)
@@ -242,16 +217,13 @@ static struct URLProtocol *url_find_protocol(const char *filename)
     char proto_str[128], proto_nested[128], *ptr;
     size_t proto_len = strspn(filename, URL_SCHEME_CHARS);
 
-    if (filename[proto_len] != ':' &&
-        (filename[proto_len] != ',' || !strchr(filename + proto_len + 1, ':')) ||
+    if (filename[proto_len] != ':' ||
         is_dos_path(filename))
         strcpy(proto_str, "file");
     else
         av_strlcpy(proto_str, filename,
                    FFMIN(proto_len + 1, sizeof(proto_str)));
 
-    if ((ptr = strchr(proto_str, ',')))
-        *ptr = '\0';
     av_strlcpy(proto_nested, proto_str, sizeof(proto_nested));
     if ((ptr = strchr(proto_nested, '+')))
         *ptr = '\0';
-- 
1.7.9.5