[FFmpeg-devel] [PATCH 3/3] avformat/hls: Be more picky on extensions
Michael Niedermayer
michael at niedermayer.cc
Thu Jan 16 13:46:02 EET 2025
On Thu, Jan 16, 2025 at 04:39:51AM +0100, Michael Niedermayer wrote:
> This blocks disallowed extensions from probing
> It also requires segments to have matching extensions to the format
>
> It is recommended to set the whitelists correctly
> instead of depending on extensions, but this should help a bit,
> and this is easier to backport
>
> Fixes: CVE-2023-6602 II. HLS Force TTY Demuxer
> Fixes: CVE-2023-6602 IV. HLS XBIN Demuxer DoS Amplification
>
> The other parts of CVE-2023-6602 have been fixed by prior commits
>
> Found-by: Harvey Phillips of Amazon Element55 (element55)
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
> libavformat/hls.c | 21 +++++++++++++++++++++
> 1 file changed, 21 insertions(+)
>
> diff --git a/libavformat/hls.c b/libavformat/hls.c
> index 045741c3b4e..a802eafc3fe 100644
> --- a/libavformat/hls.c
> +++ b/libavformat/hls.c
> @@ -223,6 +223,7 @@ typedef struct HLSContext {
> AVDictionary *avio_opts;
> AVDictionary *seg_format_opts;
> char *allowed_extensions;
> + int extension_picky;
> int max_reload;
> int http_persistent;
> int http_multiple;
> @@ -2114,6 +2115,24 @@ static int hls_read_header(AVFormatContext *s)
> pls->ctx->interrupt_callback = s->interrupt_callback;
> url = av_strdup(pls->segments[0]->url);
> ret = av_probe_input_buffer(&pls->pb.pub, &in_fmt, url, NULL, 0, 0);
> + if (c->extension_picky && ret >= 0) {
> + for (int n = 0; n < pls->n_segments; n++) {
> + struct segment *seg = pls->segments[n];
> + if ( strcmp(c->allowed_extensions, "ALL") &&
> + !av_match_ext (seg->url, c->allowed_extensions) &&
> + !ff_match_url_ext(seg->url, c->allowed_extensions)) {
> + av_log(s, AV_LOG_ERROR, "URL %s is not in allowed_extensions\n", seg->url);
> + ret = AVERROR_INVALIDDATA;
> + }
> +
> + if (!in_fmt->extensions ||
> + !av_match_ext( seg->url, in_fmt->extensions) &&
> + !ff_match_url_ext(seg->url, in_fmt->extensions)) {
> + av_log(s, AV_LOG_ERROR, "detected format extension %s mismatches url %s\n", in_fmt->extensions ? in_fmt->extensions : "none", seg->url);
> + ret = AVERROR_INVALIDDATA;
> + }
> + }
> + }
this has a bug (you can have 2 extensions in a URL one on allowed and the other
in the format), ill post a better version later
thx
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
The misfortune of the wise is better than the prosperity of the fool.
-- Epicurus
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20250116/bb4a6b47/attachment.sig>
More information about the ffmpeg-devel
mailing list