Fixes: CVE-2023-6602, V. DASH Playlist SSRF
Found-by: Harvey Phillips of Amazon Element55 (element55)
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavformat/dashdec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index 81072804441..c3f3d7f3f8d 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -446,7 +446,7 @@ static int open_url(AVFormatContext *s, AVIOContext **pb,
const char *url,
av_freep(pb);
av_dict_copy(&tmp, *opts, 0);
av_dict_copy(&tmp, opts2, 0);
- ret = avio_open2(pb, url, AVIO_FLAG_READ, c->interrupt_callback, &tmp);
+ ret = ffio_open_whitelist(pb, url, AVIO_FLAG_READ, c->interrupt_callback,
&tmp, s->protocol_whitelist, s->protocol_blacklist);
if (ret >= 0) {
// update cookies on http response with setcookies.
char *new_cookies = NULL;
@@ -1225,7 +1225,7 @@ static int parse_manifest(AVFormatContext *s, const char
*url, AVIOContext *in)
close_in = 1;
av_dict_copy(&opts, c->avio_opts, 0);
- ret = avio_open2(&in, url, AVIO_FLAG_READ, c->interrupt_callback,
&opts);
+ ret = ffio_open_whitelist(&in, url, AVIO_FLAG_READ,
c->interrupt_callback, &opts, s->protocol_whitelist, s->protocol_blacklist);
av_dict_free(&opts);
if (ret < 0)
return ret;
--
2.48.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
