diff options
| author | Anton Khirnov <anton@khirnov.net> | 2016-02-15 14:47:33 +0100 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2016-02-22 11:30:33 +0100 |
| commit | 225e84e74544062706c0159ec0737b0e1d40915f (patch) | |
| tree | 69607b17261bc009992f1a66ca5d2c86bc79c977 | |
| parent | e192cd9ce2b51c2e6919f2a78b1ce53e0024e728 (diff) | |
| download | ffmpeg-225e84e74544062706c0159ec0737b0e1d40915f.tar.gz | |
hls: disallow opening nested files in child demuxers
| -rw-r--r-- | libavformat/hls.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/libavformat/hls.c b/libavformat/hls.c index c370b6ec0c..daee8625af 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -494,6 +494,16 @@ static int save_avio_options(AVFormatContext *s) return ret; } +static int nested_io_open(AVFormatContext *s, AVIOContext **pb, const char *url, + int flags, AVDictionary **opts) +{ + av_log(s, AV_LOG_ERROR, + "A HLS playlist item '%s' referred to an external file '%s'. " + "Opening this file was forbidden for security reasons\n", + s->filename, url); + return AVERROR(EPERM); +} + static int hls_read_header(AVFormatContext *s) { HLSContext *c = s->priv_data; @@ -579,6 +589,7 @@ static int hls_read_header(AVFormatContext *s) goto fail; } v->ctx->pb = &v->pb; + v->ctx->io_open = nested_io_open; v->stream_offset = stream_offset; ret = avformat_open_input(&v->ctx, v->segments[0]->url, in_fmt, NULL); if (ret < 0) |