It is of very limited usefulness and is a source of important security
problems.
Bug-Id: CVE-2016-1897
Bug-Id: CVE-2016-1898
---
Changelog | 1 +
doc/protocols.texi | 26 -------
libavformat/Makefile | 1 -
libavformat/allformats.c | 1 -
libavformat/concat.c | 191 -----------------------------------------------
5 files changed, 1 insertion(+), 219 deletions(-)
delete mode 100644 libavformat/concat.c
diff --git a/Changelog b/Changelog
index 92c694bc..6d55284 100644
--- a/Changelog
+++ b/Changelog
@@ -51,6 +51,7 @@ version <next>:
- support Apple AVFoundation video capture
- G.723.1 muxer and encoder
- compressed SWF
+- dropped the concat protocol, because of security issues
version 11:
diff --git a/doc/protocols.texi b/doc/protocols.texi
index f30567d..4c59dff 100644
--- a/doc/protocols.texi
+++ b/doc/protocols.texi
@@ -19,32 +19,6 @@ supported protocols.
A description of the currently available protocols follows.
-@section concat
-
-Physical concatenation protocol.
-
-Allow to read and seek from many resource in sequence as if they were
-a unique resource.
-
-A URL accepted by this protocol has the syntax:
-@example
-concat:@var{URL1}|@var{URL2}|...|@var{URLN}
-@end example
-
-where @var{URL1}, @var{URL2}, ..., @var{URLN} are the urls of the
-resource to be concatenated, each one possibly specifying a distinct
-protocol.
-
-For example to read a sequence of files @file{split1.mpeg},
-@file{split2.mpeg}, @file{split3.mpeg} with @command{avplay} use the
-command:
-@example
-avplay concat:split1.mpeg\|split2.mpeg\|split3.mpeg
-@end example
-
-Note that you may need to escape the character "|" which is special for
-many shells.
-
@section file
File access protocol.
diff --git a/libavformat/Makefile b/libavformat/Makefile
index c5d1bfa..7e2c506 100644
--- a/libavformat/Makefile
+++ b/libavformat/Makefile
@@ -377,7 +377,6 @@ OBJS-$(CONFIG_LIBRTMP) += librtmp.o
# protocols I/O
OBJS-$(CONFIG_APPLEHTTP_PROTOCOL) += hlsproto.o
-OBJS-$(CONFIG_CONCAT_PROTOCOL) += concat.o
OBJS-$(CONFIG_CRYPTO_PROTOCOL) += crypto.o
OBJS-$(CONFIG_FFRTMPCRYPT_PROTOCOL) += rtmpcrypt.o rtmpdh.o
OBJS-$(CONFIG_FFRTMPHTTP_PROTOCOL) += rtmphttp.o
diff --git a/libavformat/allformats.c b/libavformat/allformats.c
index a514c63..03d610d 100644
--- a/libavformat/allformats.c
+++ b/libavformat/allformats.c
@@ -266,7 +266,6 @@ void av_register_all(void)
REGISTER_MUXDEMUX(YUV4MPEGPIPE, yuv4mpegpipe);
/* protocols */
- REGISTER_PROTOCOL(CONCAT, concat);
REGISTER_PROTOCOL(CRYPTO, crypto);
REGISTER_PROTOCOL(FFRTMPCRYPT, ffrtmpcrypt);
REGISTER_PROTOCOL(FFRTMPHTTP, ffrtmphttp);
diff --git a/libavformat/concat.c b/libavformat/concat.c
deleted file mode 100644
index 2fb3ba9..0000000
--- a/libavformat/concat.c
+++ /dev/null
@@ -1,191 +0,0 @@
-/*
- * Concat URL protocol
- * Copyright (c) 2006 Steve Lhomme
- * Copyright (c) 2007 Wolfram Gloger
- * Copyright (c) 2010 Michele Orrù
- *
- * This file is part of Libav.
- *
- * Libav is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * Libav is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with Libav; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- */
-
-#include "libavutil/avstring.h"
-#include "libavutil/mem.h"
-
-#include "avformat.h"
-#include "url.h"
-
-#define AV_CAT_SEPARATOR "|"
-
-struct concat_nodes {
- URLContext *uc; ///< node's URLContext
- int64_t size; ///< url filesize
-};
-
-struct concat_data {
- struct concat_nodes *nodes; ///< list of nodes to concat
- size_t length; ///< number of cat'ed nodes
- size_t current; ///< index of currently read node
-};
-
-static av_cold int concat_close(URLContext *h)
-{
- int err = 0;
- size_t i;
- struct concat_data *data = h->priv_data;
- struct concat_nodes *nodes = data->nodes;
-
- for (i = 0; i != data->length; i++)
- err |= ffurl_close(nodes[i].uc);
-
- av_freep(&data->nodes);
-
- return err < 0 ? -1 : 0;
-}
-
-static av_cold int concat_open(URLContext *h, const char *uri, int flags)
-{
- char *node_uri = NULL;
- int err = 0;
- int64_t size;
- size_t len, i;
- URLContext *uc;
- struct concat_data *data = h->priv_data;
- struct concat_nodes *nodes;
-
- av_strstart(uri, "concat:", &uri);
-
- for (i = 0, len = 1; uri[i]; i++) {
- if (uri[i] == *AV_CAT_SEPARATOR) {
- /* integer overflow */
- if (++len == UINT_MAX / sizeof(*nodes)) {
- av_freep(&h->priv_data);
- return AVERROR(ENAMETOOLONG);
- }
- }
- }
-
- if (!(nodes = av_realloc(NULL, sizeof(*nodes) * len)))
- return AVERROR(ENOMEM);
- else
- data->nodes = nodes;
-
- /* handle input */
- if (!*uri)
- err = AVERROR(ENOENT);
- for (i = 0; *uri; i++) {
- /* parsing uri */
- len = strcspn(uri, AV_CAT_SEPARATOR);
- if ((err = av_reallocp(&node_uri, len + 1)) < 0)
- break;
- av_strlcpy(node_uri, uri, len + 1);
- uri += len + strspn(uri + len, AV_CAT_SEPARATOR);
-
- /* creating URLContext */
- if ((err = ffurl_open(&uc, node_uri, flags,
- &h->interrupt_callback, NULL)) < 0)
- break;
-
- /* creating size */
- if ((size = ffurl_size(uc)) < 0) {
- ffurl_close(uc);
- err = AVERROR(ENOSYS);
- break;
- }
-
- /* assembling */
- nodes[i].uc = uc;
- nodes[i].size = size;
- }
- av_free(node_uri);
- data->length = i;
-
- if (err < 0)
- concat_close(h);
- else if ((err = av_reallocp(&nodes, data->length * sizeof(*nodes))) < 0)
- concat_close(h);
- else
- data->nodes = nodes;
- return err;
-}
-
-static int concat_read(URLContext *h, unsigned char *buf, int size)
-{
- int result, total = 0;
- struct concat_data *data = h->priv_data;
- struct concat_nodes *nodes = data->nodes;
- size_t i = data->current;
-
- while (size > 0) {
- result = ffurl_read(nodes[i].uc, buf, size);
- if (result < 0)
- return total ? total : result;
- if (!result) {
- if (i + 1 == data->length ||
- ffurl_seek(nodes[++i].uc, 0, SEEK_SET) < 0)
- break;
- }
- total += result;
- buf += result;
- size -= result;
- }
- data->current = i;
- return total;
-}
-
-static int64_t concat_seek(URLContext *h, int64_t pos, int whence)
-{
- int64_t result;
- struct concat_data *data = h->priv_data;
- struct concat_nodes *nodes = data->nodes;
- size_t i;
-
- switch (whence) {
- case SEEK_END:
- for (i = data->length - 1; i && pos < -nodes[i].size; i--)
- pos += nodes[i].size;
- break;
- case SEEK_CUR:
- /* get the absolute position */
- for (i = 0; i != data->current; i++)
- pos += nodes[i].size;
- pos += ffurl_seek(nodes[i].uc, 0, SEEK_CUR);
- whence = SEEK_SET;
- /* fall through with the absolute position */
- case SEEK_SET:
- for (i = 0; i != data->length - 1 && pos >= nodes[i].size; i++)
- pos -= nodes[i].size;
- break;
- default:
- return AVERROR(EINVAL);
- }
-
- result = ffurl_seek(nodes[i].uc, pos, whence);
- if (result >= 0) {
- data->current = i;
- while (i)
- result += nodes[--i].size;
- }
- return result;
-}
-
-URLProtocol ff_concat_protocol = {
- .name = "concat",
- .url_open = concat_open,
- .url_read = concat_read,
- .url_seek = concat_seek,
- .url_close = concat_close,
- .priv_data_size = sizeof(struct concat_data),
-};
--
2.0.0
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
