avformat/dashdec: Check whitelist

Fixes: CVE-2023-6602, V. DASH Playlist SSRF

Michael Niedermayer committed 1 year ago

Commit 4c96d6b1 parent c6c54941 file · +2 −2Browse files

Unified · Split

libavformat/dashdec.c+2−2

@@ -446,7 +446,7 @@ static int open_url(AVFormatContext s, AVIOContext pb, const char url, · 445 unmodified lines
446	446	av_freep(pb);
447	447	av_dict_copy(&tmp, *opts, 0);
448	448	av_dict_copy(&tmp, opts2, 0);
449		− ret = avio_open2(pb, url, AVIO_FLAG_READ, c->interrupt_callback, &tmp);
	449	+ ret = ffio_open_whitelist(pb, url, AVIO_FLAG_READ, c->interrupt_callback, &tmp, s->protocol_whitelist, s->protocol_blacklist);
450	450	if (ret >= 0) {
451	451	// update cookies on http response with setcookies.
452	452	char *new_cookies = NULL;
@@ -1225,7 +1225,7 @@ static int parse_manifest(AVFormatContext s, const char url, AVIOContext *in) · 772 unmodified lines
1225	1225	close_in = 1;
1226	1226
1227	1227	av_dict_copy(&opts, c->avio_opts, 0);
1228		− ret = avio_open2(&in, url, AVIO_FLAG_READ, c->interrupt_callback, &opts);
	1228	+ ret = ffio_open_whitelist(&in, url, AVIO_FLAG_READ, c->interrupt_callback, &opts, s->protocol_whitelist, s->protocol_blacklist);
1229	1229	av_dict_free(&opts);
1230	1230	if (ret < 0)
1231	1231	return ret;