diff options
Diffstat (limited to 'multimedia/mythtv/files/patch-CVE-2017-14058')
| -rw-r--r-- | multimedia/mythtv/files/patch-CVE-2017-14058 | 88 |
1 files changed, 88 insertions, 0 deletions
diff --git a/multimedia/mythtv/files/patch-CVE-2017-14058 b/multimedia/mythtv/files/patch-CVE-2017-14058 new file mode 100644 index 000000000000..7bd9168bbd03 --- /dev/null +++ b/multimedia/mythtv/files/patch-CVE-2017-14058 @@ -0,0 +1,88 @@ +From 2920c7cec0b1958b59e5e7990078bea4428f6912 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer <michael@niedermayer.cc> +Date: Sat, 26 Aug 2017 01:26:58 +0200 +Subject: [PATCH] avformat/hls: Fix DoS due to infinite loop + +Fixes: loop.m3u + +The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome + +Found-by: Xiaohei and Wangchu from Alibaba Security Team + +Previous version reviewed-by: Steven Liu <lingjiujianke@gmail.com> +Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> +(cherry picked from commit 7ec414892ddcad88313848494b6fc5f437c9ca4a) +Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> +--- + doc/demuxers.texi | 18 ++++++++++++++++++ + libavformat/hls.c | 7 +++++++ + 2 files changed, 25 insertions(+) + +diff --git doc/demuxers.texi doc/demuxers.texi +index 2934a1cf7f4..d56ad1622a8 100644 +--- external/FFmpeg/doc/demuxers.texi ++++ external/FFmpeg/doc/demuxers.texi +@@ -293,6 +293,24 @@ used to end the output video at the length of the shortest input file, + which in this case is @file{input.mp4} as the GIF in this example loops + infinitely. + ++@section hls ++ ++HLS demuxer ++ ++It accepts the following options: ++ ++@table @option ++@item live_start_index ++segment index to start live streams at (negative values are from the end). ++ ++@item allowed_extensions ++',' separated list of file extensions that hls is allowed to access. ++ ++@item max_reload ++Maximum number of times a insufficient list is attempted to be reloaded. ++Default value is 1000. ++@end table ++ + @section image2 + + Image file demuxer. +diff --git libavformat/hls.c libavformat/hls.c +index ffefd284f86..87948726da6 100644 +--- external/FFmpeg/libavformat/hls.c ++++ external/FFmpeg/libavformat/hls.c +@@ -205,6 +205,7 @@ typedef struct HLSContext { + AVDictionary *avio_opts; + int strict_std_compliance; + char *allowed_extensions; ++ int max_reload; + } HLSContext; + + static int read_chomp_line(AVIOContext *s, char *buf, int maxlen) +@@ -1255,6 +1256,7 @@ static int read_data(void *opaque, uint8_t *buf, int buf_size) + HLSContext *c = v->parent->priv_data; + int ret, i; + int just_opened = 0; ++ int reload_count = 0; + + restart: + if (!v->needed) +@@ -1286,6 +1288,9 @@ static int read_data(void *opaque, uint8_t *buf, int buf_size) + reload_interval = default_reload_interval(v); + + reload: ++ reload_count++; ++ if (reload_count > c->max_reload) ++ return AVERROR_EOF; + if (!v->finished && + av_gettime_relative() - v->last_load_time >= reload_interval) { + if ((ret = parse_playlist(c, v->url, v, NULL)) < 0) { +@@ -2143,6 +2148,8 @@ static const AVOption hls_options[] = { + OFFSET(allowed_extensions), AV_OPT_TYPE_STRING, + {.str = "3gp,aac,avi,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,wav"}, + INT_MIN, INT_MAX, FLAGS}, ++ {"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded", ++ OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 1000}, 0, INT_MAX, FLAGS}, + {NULL} + }; + |