Browse code

avformat/avio: Limit url option parsing to the documented cases

This feature is not know much or used much AFAIK, and it might be helpfull in
exploits.
No specific case is known where it can be used in an exploit though
subsequent commits depend on this commit though

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 984d58a3440d513f66344b5332f6b589c0a6bbc6)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Michael Niedermayer authored on 2016/01/20 17:43:54
Showing 1 changed files
... ...
@@ -155,9 +155,16 @@ static int url_alloc_for_protocol(URLContext **puc, struct URLProtocol *up,
155 155
                 char sep= *++p;
156 156
                 char *key, *val;
157 157
                 p++;
158
+
159
+                if (strcmp(up->name, "subfile"))
160
+                    ret = AVERROR(EINVAL);
161
+
158 162
                 while(ret >= 0 && (key= strchr(p, sep)) && p<key && (val = strchr(key+1, sep))){
159 163
                     *val= *key= 0;
160
-                    ret= av_opt_set(uc->priv_data, p, key+1, 0);
164
+                    if (strcmp(p, "start") && strcmp(p, "end")) {
165
+                        ret = AVERROR_OPTION_NOT_FOUND;
166
+                    } else
167
+                        ret= av_opt_set(uc->priv_data, p, key+1, 0);
161 168
                     if (ret == AVERROR_OPTION_NOT_FOUND)
162 169
                         av_log(uc, AV_LOG_ERROR, "Key '%s' not found.\n", p);
163 170
                     *val= *key= sep;
... ...
@@ -222,7 +229,7 @@ static struct URLProtocol *url_find_protocol(const char *filename)
222 222
     size_t proto_len = strspn(filename, URL_SCHEME_CHARS);
223 223
 
224 224
     if (filename[proto_len] != ':' &&
225
-        (filename[proto_len] != ',' || !strchr(filename + proto_len + 1, ':')) ||
225
+        (strncmp(filename, "subfile,", 8) || !strchr(filename + proto_len + 1, ':')) ||
226 226
         is_dos_path(filename))
227 227
         strcpy(proto_str, "file");
228 228
     else