From: xiaohuanshu <xiaohuan...@gmail.com>
Problem:
The max_url_size calculation for DASH segment URLs only considered the base URL
length, leading to buffer overflow when the segment's sourceURL exceeded the
pre-allocated buffer. This triggered the log error:
"DASH request for url 'invalid:truncated'".
Reproduce:
1. A test sample "long-sourceurl-sample.mpd" (deliberately designed with a long
sourceURL) was uploaded to VideoLAN's repository.
2. Reproduce with short base path:
ffmpeg -i /tmp/short_path/long-sourceurl-sample.mpd
-> Triggers "invalid:truncated" error
3. With artificially lengthened base path (e.g. /aaa/../bbb/../...):
ffmpeg -i /long/../path/../with/../many/../segments/long-sourceurl-sample.mpd
-> URL resolves correctly (though HTTP fetch fails due to fake URL)
Fix:
Recalculate max_url_size by considering both base URL and sourceURL lengths,
ensuring sufficient buffer allocation during URL concatenation.
V2:
1. no need to determine whether initialization_val is null.
2. fix the incorrect variable name.
V3:
1. change `max_url_size` scope into `Initialization` and `Media` blocks.
Signed-off-by: xiaohuanshu <xiaohuan...@gmail.com>
---
libavformat/dashdec.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index c3f3d7f3f8..31a84bd184 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -606,7 +606,6 @@ static int parse_manifest_segmenturlnode(AVFormatContext
*s, struct representati
char *initialization_val = NULL;
char *media_val = NULL;
char *range_val = NULL;
- int max_url_size = c ? c->max_url_size: MAX_URL_SIZE;
int err;
if (!av_strcasecmp(fragmenturl_node->name, "Initialization")) {
@@ -620,6 +619,12 @@ static int parse_manifest_segmenturlnode(AVFormatContext
*s, struct representati
xmlFree(initialization_val);
return AVERROR(ENOMEM);
}
+ int max_url_size = FFMAX(
+ c ? c->max_url_size : 0,
+ aligned(strlen(initialization_val) +
+ (rep_id_val ? strlen(rep_id_val) : 0) +
+ (rep_bandwidth_val ? strlen(rep_bandwidth_val) : 0)));
+ max_url_size = max_url_size ? max_url_size : MAX_URL_SIZE;
rep->init_section->url = get_content_url(baseurl_nodes, 4,
max_url_size,
rep_id_val,
@@ -641,6 +646,11 @@ static int parse_manifest_segmenturlnode(AVFormatContext
*s, struct representati
xmlFree(media_val);
return AVERROR(ENOMEM);
}
+ int max_url_size = FFMAX(
+ c ? c->max_url_size : 0,
+ aligned(strlen(media_val) + (rep_id_val ? strlen(rep_id_val) :
0) +
+ (rep_bandwidth_val ? strlen(rep_bandwidth_val) : 0)));
+ max_url_size = max_url_size ? max_url_size : MAX_URL_SIZE;
seg->url = get_content_url(baseurl_nodes, 4,
max_url_size,
rep_id_val,
--
2.39.5 (Apple Git-154)
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
