From 3249c757aed678780e22e99a1a49f4672851bca9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Ekstr=C3=B6m?= Date: Thu, 3 Sep 2020 19:50:08 +0300 Subject: [PATCH] avformat/dashdec: drop arbitrary DASH manifest size limit Currently the utilized AVBPrint API is internally limited to unsigned integers, so if we limit the file size as well as the amount to read to UINT_MAX - 1, we do not require additional limiting to be performed on the values. This change is based on the fact that initially the 8*1024 value added in 96d70694aea64616c68db8be306c159c73fb3980 was only for the case where the file size was not known. It was not a maximum file size limit. In 29121188983932f79aef8501652630d322a9974c this was reworked to be a maximum manifest file size limit, while its commit message appears to only note that it added support for larger manifest file sizes. This should enable various unfortunately large MPEG-DASH manifests, such as Youtube's multi-megabyte live stream archives to load up as well as bring back the original intent of the logic. --- libavformat/dashdec.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c index c5a5ff607b..1e9985f32c 100644 --- a/libavformat/dashdec.c +++ b/libavformat/dashdec.c @@ -29,7 +29,7 @@ #include "dash.h" #define INITIAL_BUFFER_SIZE 32768 -#define MAX_MANIFEST_SIZE 50 * 1024 +#define MAX_BPRINT_READ_SIZE (UINT_MAX - 1) #define DEFAULT_MANIFEST_SIZE 8 * 1024 struct fragment { @@ -1256,14 +1256,16 @@ static int parse_manifest(AVFormatContext *s, const char *url, AVIOContext *in) } filesize = avio_size(in); - if (filesize > MAX_MANIFEST_SIZE) { + filesize = filesize > 0 ? filesize : DEFAULT_MANIFEST_SIZE; + + if (filesize > MAX_BPRINT_READ_SIZE) { av_log(s, AV_LOG_ERROR, "Manifest too large: %"PRId64"\n", filesize); return AVERROR_INVALIDDATA; } - av_bprint_init(&buf, (filesize > 0) ? filesize + 1 : DEFAULT_MANIFEST_SIZE, AV_BPRINT_SIZE_UNLIMITED); + av_bprint_init(&buf, filesize + 1, AV_BPRINT_SIZE_UNLIMITED); - if ((ret = avio_read_to_bprint(in, &buf, MAX_MANIFEST_SIZE)) < 0 || + if ((ret = avio_read_to_bprint(in, &buf, MAX_BPRINT_READ_SIZE)) < 0 || !avio_feof(in) || (filesize = buf.len) == 0) { av_log(s, AV_LOG_ERROR, "Unable to read to manifest '%s'\n", url);