[FFmpeg-devel] [PATCH 2/2] avformat/concatdec: Check recursion depth

[Michael Niedermayer]

This variant is easy backportable but is concatdec specific

Fixes: self_ref.ffconcat
Reported-by: Yuhao Jiang <danisjiang at gmail.com>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavformat/concatdec.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/libavformat/concatdec.c b/libavformat/concatdec.c
index fe65d0c7688..66b8f417983 100644
--- a/libavformat/concatdec.c
+++ b/libavformat/concatdec.c
@@ -72,6 +72,7 @@ typedef struct {
     ConcatMatchMode stream_match_mode;
     unsigned auto_convert;
     int segment_time_metadata;
+    int recursion_depth;
 } ConcatContext;
 
 static int concat_probe(const AVProbeData *probe)
@@ -356,6 +357,8 @@ static int open_file(AVFormatContext *avf, unsigned fileno)
     if (ret < 0)
         return ret;
 
+    av_dict_set_int(&options, "recursion_depth", cat->recursion_depth - 1, 0);
+
     if ((ret = avformat_open_input(&cat->avf, file->url, NULL, &options)) < 0 ||
         (ret = avformat_find_stream_info(cat->avf, NULL)) < 0) {
         av_log(avf, AV_LOG_ERROR, "Impossible to open '%s'\n", file->url);
@@ -363,6 +366,7 @@ static int open_file(AVFormatContext *avf, unsigned fileno)
         avformat_close_input(&cat->avf);
         return ret;
     }
+    av_dict_set(&options, "recursion_depth", NULL, 0);
     if (options) {
         av_log(avf, AV_LOG_WARNING, "Unused options for '%s'.\n", file->url);
         /* TODO log unused options once we have a proper string API */
@@ -664,6 +668,11 @@ static int concat_read_header(AVFormatContext *avf)
     unsigned i;
     int ret;
 
+    if (cat->recursion_depth <= 0) {
+        av_log(avf, AV_LOG_ERROR, "Too deep recursion\n");
+        return AVERROR(ELOOP);
+    }
+
     ret = concat_parse_script(avf);
     if (ret < 0)
         return ret;
@@ -939,6 +948,8 @@ static const AVOption options[] = {
       OFFSET(auto_convert), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, DEC },
     { "segment_time_metadata", "output file segment start time and duration as packet metadata",
       OFFSET(segment_time_metadata), AV_OPT_TYPE_BOOL, {.i64 = 0}, 0, 1, DEC },
+    { "recursion_depth", "max recursion depth",
+      OFFSET(recursion_depth), AV_OPT_TYPE_INT, {.i64 = 10}, 0, INT_MAX, DEC },
     { NULL }
 };
 
-- 
2.49.0