Michael Niedermayer e447d3143f avformat/hls: Check local file extensions ... This reduces the attack surface of local file-system information leaking. It prevents the existing exploit leading to an information leak. As well as similar hypothetical attacks. Leaks of information from files and symlinks ending in common multimedia extensions are still possible. But files with sensitive information like private keys and passwords generally do not use common multimedia filename extensions. It does not stop leaks via remote addresses in the LAN. The existing exploit depends on a specific decoder as well. It does appear though that the exploit should be possible with any decoder. The problem is that as long as sensitive information gets into the decoder, the output of the decoder becomes sensitive as well. The only obvious solution is to prevent access to sensitive information. Or to disable hls or possibly some of its feature. More complex solutions like checking the path to limit access to only subdirectories of the hls path may work as an alternative. But such solutions are fragile and tricky to implement portably and would not stop every possible attack nor would they work with all valid hls files. Developers have expressed their dislike / objected to disabling hls by default as well as disabling hls with local files. There also where objections against restricting remote url file extensions. This here is a less robust but also lower inconvenience solution. It can be applied stand alone or together with other solutions. limiting the check to local files was suggested by nevcairiel This recommits the security fix without the author name joke which was originally requested by Nicolas. Found-by: Emil Lerner and Pavel Cheremushkin Reported-by: Thierry Foucu <tfoucu@google.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 189ff42196) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>		2017-06-05 23:16:54 +02:00
..
4xm.c
a64.c
aacdec.c
aadec.c
ac3dec.c
act.c
adp.c
adtsenc.c
adxdec.c
aea.c
afc.c
aiff.h
aiffdec.c
aiffenc.c
allformats.c	avformat/allformats: Making av_register_all() thread-safe.	2016-08-15 18:54:34 +02:00
amr.c
anm.c
apc.c
ape.c
apetag.c
apetag.h
apngdec.c	avformat/apng: fix setting frame delay when max_fps is set to no limit	2017-03-21 20:21:12 -03:00
apngenc.c
aqtitledec.c
asf.c
asf.h
asfcrypt.c
asfcrypt.h
asfdec_f.c
asfdec_o.c	asfdec_o: check for too small size in asf_read_unknown	2016-01-27 23:45:45 +01:00
asfenc.c	avformat/asfenc: Check pts	2016-01-15 12:30:40 +01:00
assdec.c
assenc.c
ast.c
ast.h
astdec.c
astenc.c
async.c
au.c
audiointerleave.c
audiointerleave.h
avc.c
avc.h
avformat.h	avformat: Add max_streams option	2017-02-08 21:17:50 +01:00
avformatres.rc
avi.h
avidec.c	avformat/avidec: Limit formats in gab2 to srt and ass/ssa	2017-06-05 23:16:54 +02:00
avienc.c
avio_internal.h
avio.c	avformat/avio: Limit url option parsing to the documented cases	2016-01-28 15:53:54 +01:00
avio.h
aviobuf.c	avformat/aviobuf: Fix end check in put_str16()	2016-01-15 12:30:40 +01:00
avisynth.c
avlanguage.c
avlanguage.h
avr.c
avs.c
bethsoftvid.c
bfi.c
bink.c
bintext.c
bit.c
bluray.c
bmv.c
boadec.c
brstm.c	brstm: fix missing closing brace	2016-01-27 23:45:44 +01:00
c93.c
cache.c	avformat/cache: Fix memleak of tree entries	2016-04-27 04:40:11 +02:00
caf.c
caf.h
cafdec.c
cafenc.c
cavsvideodec.c
cdg.c
cdxl.c
cinedec.c
concat.c	avformat/concat: Check protocol prefix	2016-01-28 15:53:54 +01:00
concatdec.c	avformat/concatdec: fix the h264 annexb extradata check	2017-05-19 23:37:59 -03:00
crcenc.c
crypto.c
cutils.c
dashenc.c
data_uri.c
dauddec.c
daudenc.c
dfa.c
diracdec.c
dnxhddec.c
dsfdec.c
dsicin.c
dss.c
dtsdec.c
dtshddec.c
dump.c	avformat/dump: Fix integer overflow in av_dump_format()	2015-12-06 02:51:27 +01:00
dv.c
dv.h
dvbsub.c
dvenc.c
dxa.c
eacdata.c
electronicarts.c
epafdec.c
ffm.h
ffmdec.c	avformat/ffmdec: Check media type for chunks	2016-12-03 17:46:37 +01:00
ffmenc.c
ffmeta.h
ffmetadec.c
ffmetaenc.c
file_open.c
file.c
filmstripdec.c	filmstripdec: correctly check image dimensions	2016-11-27 00:46:36 +01:00
filmstripenc.c
flac_picture.c
flac_picture.h
flacdec.c	avformat/flacdec: Check avio_read result when reading flac block header.	2017-02-08 21:17:51 +01:00
flacenc_header.c
flacenc.c
flacenc.h
flic.c
flv.h
flvdec.c
flvenc.c
format.c	avformat/format: Fix registering a format more than once and related races	2016-08-15 20:25:13 +02:00
framecrcenc.c
framehash.c
frmdec.c
ftp.c
g722.c
g723_1.c
g729dec.c
gif.c
gifdec.c
golomb_tab.c
gopher.c
gsmdec.c
gxf.c
gxf.h
gxfenc.c
h261dec.c
h263dec.c
h264dec.c
hdsenc.c
hevc.c
hevc.h
hevcdec.c
hls.c	avformat/hls: Check local file extensions	2017-06-05 23:16:54 +02:00
hlsenc.c	avformat/hlsenc: Check the return code of avformat_write_header()	2015-12-13 02:59:32 +01:00
hlsproto.c
hnm.c
http.c	avformat/http: Check for truncated buffers in http_connect()	2017-05-20 03:41:32 +02:00
http.h
httpauth.c
httpauth.h
icecast.c
icodec.c	icodec: correctly check avio_read return value	2016-11-27 00:46:34 +01:00
icoenc.c
id3v1.c
id3v1.h
id3v2.c
id3v2.h
id3v2enc.c
idcin.c
idroqdec.c	avformat/idroqdec: Check chunk_size for being too large	2016-12-01 23:50:40 +01:00
idroqenc.c
iff.c
ilbc.c
img2_alias_pix.c
img2_brender_pix.c
img2.c
img2.h	avformat/img2dec: do not interpret the filename by default if a IO context has been opened	2016-01-28 15:53:54 +01:00
img2dec.c	avformat/img2dec: Use AVOpenCallback	2016-01-28 15:53:54 +01:00
img2enc.c
ingenientdec.c
internal.h
ipmovie.c	avformat/ipmovie: put video decoding_map_size into packet and use it in decoder	2016-01-27 23:28:49 +01:00
ircam.c
ircam.h
ircamdec.c
ircamenc.c
isom.c
isom.h	mov: Add an option to toggle dref opening	2016-01-28 15:53:53 +01:00
iss.c
iv8.c
ivfdec.c
ivfenc.c	avformat/ivfenc: fix division by zero	2016-01-15 12:30:40 +01:00
jacosubdec.c
jacosubenc.c
jvdec.c
latmenc.c
libavformat.v
libgme.c
libmodplug.c
libnut.c
libquvi.c	avformat/libquvi: Set default demuxer and protocol limitations	2016-01-28 15:53:54 +01:00
librtmp.c	librtmp: Avoid an infiniloop setting connection arguments	2016-07-26 12:08:58 -07:00
libsmbclient.c
libssh.c
lmlm4.c
loasdec.c
log2_tab.c
lrc.c
lrc.h
lrcdec.c
lrcenc.c
lvfdec.c
lxfdec.c
m4vdec.c
Makefile
matroska.c
matroska.h
matroskadec.c	lavf/matroskadec: fix is_keyframe for early Blocks	2017-02-08 21:17:51 +01:00
matroskaenc.c	avformat/matroskaenc: Check codecdelay before use	2015-12-09 18:27:54 +01:00
md5enc.c
md5proto.c
metadata.c
metadata.h
mgsts.c
microdvddec.c
microdvdenc.c
mkvtimestamp_v2.c
mlvdec.c	mlvdec: check that index_entries exist	2015-12-20 02:42:13 +01:00
mm.c
mmf.c
mms.c
mms.h
mmsh.c
mmst.c
mov_chan.c
mov_chan.h
mov.c	lavf/mov.c: Avoid heap allocation wrap in mov_read_uuid	2017-02-08 21:17:51 +01:00
movenc.c	avformat/movenc: Check packet in mov_write_single_packet() too	2016-09-18 00:18:11 +02:00
movenc.h
movenchint.c
mp3dec.c
mp3enc.c
mpc8.c
mpc.c
mpeg.c	lavf/mpeg: Initialize a stack variable used by memcmp().	2017-02-21 02:16:28 +01:00
mpeg.h
mpegenc.c
mpegts.c	mpegts: prevent division by zero	2016-11-27 00:46:34 +01:00
mpegts.h
mpegtsenc.c	mpegencts: Fix overflow in cbr mode period calculations	2015-12-06 02:51:27 +01:00
mpegvideodec.c
mpjpeg.c
mpjpegdec.c
mpl2dec.c
mpsubdec.c
msnwc_tcp.c
mtv.c
mux.c	avformat/mux: Fix copy an paste typo	2017-06-05 23:16:54 +02:00
mvdec.c
mvi.c
mxf.c
mxf.h
mxfdec.c	mxfdec: fix NULL pointer dereference in mxf_read_packet_old	2016-11-27 00:46:35 +01:00
mxfenc.c	avformat/mxfenc: Do not crash if there is no packet in the first stream	2015-12-13 17:27:04 +01:00
mxg.c
ncdec.c
network.c
network.h
nistspheredec.c
noproxy-test.c
nsvdec.c
nullenc.c
nut.c
nut.h
nutdec.c	nutdec: reject negative value_len in read_sm_data	2015-12-20 13:39:41 +01:00
nutenc.c
nuv.c	nuv: sanitize negative fps rate	2015-12-20 13:39:45 +01:00
oggdec.c	avformat/oggdec: Skip streams in duration correction that did not had their duration set.	2017-02-08 21:17:50 +01:00
oggdec.h	avformat/oggdec: Fix integer overflow with invalid pts	2016-08-15 20:25:13 +02:00
oggenc.c
oggparsecelt.c
oggparsedirac.c
oggparseflac.c
oggparseogm.c
oggparseopus.c	avformat/oggparseopus: Fix Undefined behavior in oggparseopus.c and libavformat/utils.c	2016-08-15 18:54:34 +02:00
oggparseskeleton.c
oggparsespeex.c	avformat/oggparsespeex: Check frames_per_packet and packet_size	2016-12-03 04:10:31 +01:00
oggparsetheora.c
oggparsevorbis.c
oggparsevp8.c	avformat/oggparsevp8: fix pts calculation on pages ending with an invisible frame	2016-07-25 09:59:54 -03:00
oma.c
oma.h
omadec.c
omaenc.c
options_table.h	avformat/options_table: Set the default maximum number of streams to 1000	2017-02-08 21:17:50 +01:00
options.c
os_support.c
os_support.h
paf.c
pcm.c
pcm.h
pcmdec.c
pcmenc.c
pjsdec.c
pmpdec.c
psxstr.c
pva.c
pvfdec.c
qcp.c
qtpalette.h
r3d.c
rawdec.c
rawdec.h
rawenc.c
rawenc.h
rawvideodec.c
rdt.c
rdt.h
realtextdec.c
redspark.c
replaygain.c
replaygain.h
riff.c
riff.h
riffdec.c	avformat/riffdec: Initialize bitrate	2015-12-06 02:51:27 +01:00
riffenc.c
rl2.c
rm.c
rm.h
rmdec.c
rmenc.c
rmsipr.c
rmsipr.h
rpl.c
rsd.c
rso.c
rso.h
rsodec.c
rsoenc.c
rtmp.h
rtmpcrypt.c	rtmpcrypt: Do the xtea decryption in little endian mode	2015-11-26 16:06:39 +01:00
rtmpcrypt.h
rtmpdh.c
rtmpdh.h
rtmphttp.c
rtmppkt.c	avformat/rtmppkt: Check for packet size mismatches	2016-12-06 00:59:22 +01:00
rtmppkt.h
rtmpproto.c
rtp.c
rtp.h
rtpdec_ac3.c
rtpdec_amr.c
rtpdec_asf.c	libavformat/rtpdec_asf: zero initialize the AVIOContext struct	2016-08-15 20:25:13 +02:00
rtpdec_dv.c
rtpdec_formats.h
rtpdec_g726.c
rtpdec_h261.c
rtpdec_h263_rfc2190.c
rtpdec_h263.c
rtpdec_h264.c
rtpdec_hevc.c
rtpdec_ilbc.c
rtpdec_jpeg.c	avformat/rtpdec_jpeg: fix low contrast image on low quality setting	2016-04-27 04:40:11 +02:00
rtpdec_latm.c
rtpdec_mpa_robust.c
rtpdec_mpeg4.c
rtpdec_mpeg12.c
rtpdec_mpegts.c
rtpdec_qcelp.c
rtpdec_qdm2.c
rtpdec_qt.c
rtpdec_svq3.c
rtpdec_vp8.c
rtpdec_vp9.c
rtpdec_xiph.c
rtpdec.c
rtpdec.h
rtpenc_aac.c
rtpenc_amr.c
rtpenc_chain.c
rtpenc_chain.h
rtpenc_h261.c
rtpenc_h263_rfc2190.c
rtpenc_h263.c
rtpenc_h264_hevc.c
rtpenc_jpeg.c	lavf/rtpenc_jpeg: Less strict check for standard Huffman tables.	2015-12-02 14:56:53 +01:00
rtpenc_latm.c
rtpenc_mpegts.c
rtpenc_mpv.c
rtpenc_vp8.c
rtpenc_xiph.c
rtpenc.c	avformat/rtpenc: Fix integer overflow in NTP_TO_RTP_FORMAT	2016-04-27 04:40:11 +02:00
rtpenc.h
rtpproto.c
rtpproto.h
rtsp.c
rtsp.h
rtspcodes.h
rtspdec.c
rtspenc.c
samidec.c
sapdec.c
sapenc.c
sauce.c
sauce.h
sbgdec.c	sbgdec: prevent NULL pointer access	2016-11-27 00:46:35 +01:00
sctp.c
sdp.c
sdr2.c
seek-test.c
segafilm.c
segment.c
sierravmd.c
siff.c
smacker.c	avformat/smacker: fix integer overflow with pts_inc	2015-12-06 02:51:27 +01:00
smjpeg.c
smjpeg.h
smjpegdec.c
smjpegenc.c
smoothstreamingenc.c
smush.c
sol.c
sox.h
soxdec.c
soxenc.c
spdif.c
spdif.h
spdifdec.c
spdifenc.c
srtdec.c
srtenc.c
srtp.c
srtp.h
srtpproto.c
stldec.c
subfile.c
subtitles.c
subtitles.h
subviewer1dec.c
subviewerdec.c
supdec.c
swf.c
swf.h
swfdec.c	avformat/swfdec: Fix inflate() error code check	2016-08-19 11:03:50 +02:00
swfenc.c
takdec.c
tcp.c
tedcaptionsdec.c
tee.c	lavf/tee: fix side data double free.	2015-12-13 10:14:24 +01:00
thp.c
tiertexseq.c
tls_gnutls.c
tls_openssl.c
tls_securetransport.c
tls.c
tls.h
tmv.c
tta.c
tty.c
txd.c
udp.c
uncodedframecrcenc.c
unix.c
url-test.c
url.c
url.h
urldecode.c
urldecode.h
utils.c	avformat/utils: free AVStream.codec properly in free_stream()	2017-05-19 23:37:49 -03:00
vc1test.c
vc1testenc.c
version.h
vivo.c
voc.c
voc.h
vocdec.c
vocenc.c
vorbiscomment.c
vorbiscomment.h
vplayerdec.c
vqf.c
w64.c
w64.h
wavdec.c	avformat/wavdec: Check chunk_size	2017-05-20 03:41:33 +02:00
wavenc.c
wc3movie.c
webm_chunk.c
webmdashenc.c	avformat/webmdashenc: Validate the 'streams' adaptation sets parameter	2017-05-20 03:41:33 +02:00
webpenc.c
webvttdec.c
webvttenc.c
westwood_aud.c
westwood_vqa.c
wtv_common.c
wtv.h
wtvdec.c
wtvenc.c
wv.c
wv.h
wvdec.c
wvenc.c
xa.c
xmv.c
xwma.c
yop.c
yuv4mpeg.h
yuv4mpegdec.c
yuv4mpegenc.c