[FFmpeg-devel] [PATCH] libavformat/dashdec: Fix buffer overflow in segment URL resolution

[xiaohuanshu at gmail.com]

From: xiaohuanshu <xiaohuanshu at gmail.com>

Problem:
The max_url_size calculation for DASH segment URLs only considered the base URL
length, leading to buffer overflow when the segment's sourceURL exceeded the
pre-allocated buffer. This triggered the log error:
"DASH request for url 'invalid:truncated'".

Reproduce:
1. A test sample "long-sourceurl-sample.mpd" (deliberately designed with a long
   sourceURL) was uploaded to VideoLAN's repository.
2. Reproduce with short base path:
   ffmpeg -i /tmp/short_path/long-sourceurl-sample.mpd
   -> Triggers "invalid:truncated" error
3. With artificially lengthened base path (e.g. /aaa/../bbb/../...):
   ffmpeg -i /long/../path/../with/../many/../segments/long-sourceurl-sample.mpd
   -> URL resolves correctly (though HTTP fetch fails due to fake URL)

Fix:
Recalculate max_url_size by considering both base URL and sourceURL lengths,
ensuring sufficient buffer allocation during URL concatenation.

Signed-off-by: xiaohuanshu <xiaohuanshu at gmail.com>
---
 libavformat/dashdec.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index c3f3d7f3f8..f604d363c4 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -606,7 +606,7 @@ static int parse_manifest_segmenturlnode(AVFormatContext *s, struct representati
     char *initialization_val = NULL;
     char *media_val = NULL;
     char *range_val = NULL;
-    int max_url_size = c ? c->max_url_size: MAX_URL_SIZE;
+    int max_url_size = 0;
     int err;
 
     if (!av_strcasecmp(fragmenturl_node->name, "Initialization")) {
@@ -620,6 +620,12 @@ static int parse_manifest_segmenturlnode(AVFormatContext *s, struct representati
                 xmlFree(initialization_val);
                 return AVERROR(ENOMEM);
             }
+            max_url_size = FFMAX(
+                c ? c->max_url_size : 0,
+                initialization_val ? aligned(strlen(initialization_val) +
+                                             (rep_id_val ? strlen(rep_id_val) : 0) +
+                                             (rep_bandwidth_val ? strlen(rep_bandwidth_val) : 0)) : 0);
+            max_url_size = max_url_size ? max_url_size : MAX_URL_SIZE;
             rep->init_section->url = get_content_url(baseurl_nodes, 4,
                                                      max_url_size,
                                                      rep_id_val,
@@ -641,6 +647,12 @@ static int parse_manifest_segmenturlnode(AVFormatContext *s, struct representati
                 xmlFree(media_val);
                 return AVERROR(ENOMEM);
             }
+            max_url_size = FFMAX(
+                c ? c->max_url_size : 0,
+                initialization_val ? aligned(strlen(initialization_val) +
+                                             (rep_id_val ? strlen(rep_id_val) : 0) +
+                                             (rep_bandwidth_val ? strlen(rep_bandwidth_val) : 0)) : 0);
+            max_url_size = max_url_size ? max_url_size : MAX_URL_SIZE;
             seg->url = get_content_url(baseurl_nodes, 4,
                                        max_url_size,
                                        rep_id_val,
-- 
2.39.5 (Apple Git-154)