Skip to content
Permalink
Browse files Browse the repository at this point in the history
avformat/hls: Fix DoS due to infinite loop
Fixes: loop.m3u

The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome

Found-by: Xiaohei and Wangchu from Alibaba Security Team

Previous version reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
  • Loading branch information
michaelni committed Aug 27, 2017
1 parent 2634927 commit 7ec4148
Show file tree
Hide file tree
Showing 2 changed files with 25 additions and 0 deletions.
18 changes: 18 additions & 0 deletions doc/demuxers.texi
Expand Up @@ -300,6 +300,24 @@ used to end the output video at the length of the shortest input file,
which in this case is @file{input.mp4} as the GIF in this example loops
infinitely.

@section hls

HLS demuxer

It accepts the following options:

@table @option
@item live_start_index
segment index to start live streams at (negative values are from the end).

@item allowed_extensions
',' separated list of file extensions that hls is allowed to access.

@item max_reload
Maximum number of times a insufficient list is attempted to be reloaded.
Default value is 1000.
@end table

@section image2

Image file demuxer.
Expand Down
7 changes: 7 additions & 0 deletions libavformat/hls.c
Expand Up @@ -205,6 +205,7 @@ typedef struct HLSContext {
AVDictionary *avio_opts;
int strict_std_compliance;
char *allowed_extensions;
int max_reload;
} HLSContext;

static int read_chomp_line(AVIOContext *s, char *buf, int maxlen)
Expand Down Expand Up @@ -1263,6 +1264,7 @@ static int read_data(void *opaque, uint8_t *buf, int buf_size)
HLSContext *c = v->parent->priv_data;
int ret, i;
int just_opened = 0;
int reload_count = 0;

restart:
if (!v->needed)
Expand Down Expand Up @@ -1294,6 +1296,9 @@ static int read_data(void *opaque, uint8_t *buf, int buf_size)
reload_interval = default_reload_interval(v);

reload:
reload_count++;
if (reload_count > c->max_reload)
return AVERROR_EOF;
if (!v->finished &&
av_gettime_relative() - v->last_load_time >= reload_interval) {
if ((ret = parse_playlist(c, v->url, v, NULL)) < 0) {
Expand Down Expand Up @@ -2150,6 +2155,8 @@ static const AVOption hls_options[] = {
OFFSET(allowed_extensions), AV_OPT_TYPE_STRING,
{.str = "3gp,aac,avi,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,wav"},
INT_MIN, INT_MAX, FLAGS},
{"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded",
OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 1000}, 0, INT_MAX, FLAGS},
{NULL}
};

Expand Down

1 comment on commit 7ec4148

@shqking
Copy link

@shqking shqking commented on 7ec4148 Sep 1, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please sign in to comment.