virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

avformat/dashdec: Check whitelist

Browse Source 
Fixes: CVE-2023-6602, V. DASH Playlist SSRF

Found-by: Harvey Phillips of Amazon Element55 (element55)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2025-01-16 00:22:05 +01:00
parent c6c54943d1
commit 4c96d6bf75
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libavformat/dashdec.c
View File

@@ -446,7 +446,7 @@ static int open_url(AVFormatContext *s, AVIOContext **pb, const char *url,
av_freep(pb); av_freep(pb);
av_dict_copy(&tmp, *opts, 0); av_dict_copy(&tmp, *opts, 0);
av_dict_copy(&tmp, opts2, 0); av_dict_copy(&tmp, opts2, 0);
ret = avio_open2(pb, url, AVIO_FLAG_READ, c->interrupt_callback, &tmp); ret = ffio_open_whitelist(pb, url, AVIO_FLAG_READ, c->interrupt_callback, &tmp, s->protocol_whitelist, s->protocol_blacklist);
if (ret >= 0) { if (ret >= 0) {
// update cookies on http response with setcookies. // update cookies on http response with setcookies.
char *new_cookies = NULL; char *new_cookies = NULL;
@@ -1225,7 +1225,7 @@ static int parse_manifest(AVFormatContext *s, const char *url, AVIOContext *in)
close_in = 1; close_in = 1;
av_dict_copy(&opts, c->avio_opts, 0); av_dict_copy(&opts, c->avio_opts, 0);
ret = avio_open2(&in, url, AVIO_FLAG_READ, c->interrupt_callback, &opts); ret = ffio_open_whitelist(&in, url, AVIO_FLAG_READ, c->interrupt_callback, &opts, s->protocol_whitelist, s->protocol_blacklist);
av_dict_free(&opts); av_dict_free(&opts);
if (ret < 0) if (ret < 0)
return ret; return ret;