Hi
On Fri, Apr 11, 2025 at 03:48:08PM +0800, xiaohuan...@gmail.com wrote:
> From: xiaohuanshu <xiaohuan...@gmail.com>
>
> Problem:
> The max_url_size calculation for DASH segment URLs only considered the base
> URL
> length, leading to buffer overflow when the segment's sourceURL exceeded the
> pre-allocated buffer. This triggered the log error:
> "DASH request for url 'invalid:truncated'".
>
> Reproduce:
> 1. A test sample "long-sourceurl-sample.mpd" (deliberately designed with a
> long
> sourceURL) was uploaded to VideoLAN's repository.
> 2. Reproduce with short base path:
> ffmpeg -i /tmp/short_path/long-sourceurl-sample.mpd
> -> Triggers "invalid:truncated" error
> 3. With artificially lengthened base path (e.g. /aaa/../bbb/../...):
> ffmpeg -i
> /long/../path/../with/../many/../segments/long-sourceurl-sample.mpd
> -> URL resolves correctly (though HTTP fetch fails due to fake URL)
>
> Fix:
> Recalculate max_url_size by considering both base URL and sourceURL lengths,
> ensuring sufficient buffer allocation during URL concatenation.
>
> Signed-off-by: xiaohuanshu <xiaohuan...@gmail.com>
> ---
> libavformat/dashdec.c | 14 +++++++++++++-
> 1 file changed, 13 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
> index c3f3d7f3f8..f604d363c4 100644
> --- a/libavformat/dashdec.c
> +++ b/libavformat/dashdec.c
> @@ -606,7 +606,7 @@ static int parse_manifest_segmenturlnode(AVFormatContext
> *s, struct representati
> char *initialization_val = NULL;
> char *media_val = NULL;
> char *range_val = NULL;
> - int max_url_size = c ? c->max_url_size: MAX_URL_SIZE;
> + int max_url_size = 0;
> int err;
>
> if (!av_strcasecmp(fragmenturl_node->name, "Initialization")) {
> @@ -620,6 +620,12 @@ static int parse_manifest_segmenturlnode(AVFormatContext
> *s, struct representati
> xmlFree(initialization_val);
> return AVERROR(ENOMEM);
> }
> + max_url_size = FFMAX(> + c ? c->max_url_size : 0, how can c be NULL here ? > + initialization_val ? aligned(strlen(initialization_val) + > + (rep_id_val ? > strlen(rep_id_val) : 0) + > + (rep_bandwidth_val ? > strlen(rep_bandwidth_val) : 0)) : 0); > + max_url_size = max_url_size ? max_url_size : MAX_URL_SIZE; > rep->init_section->url = get_content_url(baseurl_nodes, 4, > max_url_size, > rep_id_val, > @@ -641,6 +647,12 @@ static int parse_manifest_segmenturlnode(AVFormatContext > *s, struct representati > xmlFree(media_val); > return AVERROR(ENOMEM); > } > + max_url_size = FFMAX( > + c ? c->max_url_size : 0, > + initialization_val ? aligned(strlen(initialization_val) + how can initialization_val be non NULL here ? thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB I have often repented speaking, but never of holding my tongue. -- Xenocrates
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
