Index: modules/demux/playlist/m3u.c =================================================================== --- modules/demux/playlist/m3u.c (revision 23851) +++ modules/demux/playlist/m3u.c (working copy) @@ -150,22 +150,20 @@ else if( !strncasecmp( psz_parse, "EXTVLCOPT:", sizeof("EXTVLCOPT:") -1 ) ) { - if( b_enable_extvlcopt ) - { /* VLC Option */ char *psz_option; psz_parse += sizeof("EXTVLCOPT:") -1; if( !*psz_parse ) goto error; psz_option = MaybeFromLocaleDup( psz_parse ); - if( psz_option ) + if( psz_option && (b_enable_extvlcopt || input_OptionIsSecure( psz_option )) ) INSERT_ELEM( ppsz_options, i_options, i_options, psz_option ); - } - else - { - msg_Err( p_demux, "m3u EXTVLCOPT parsing is disabled for security reasons. If you need it and trust the m3u playlist you are trying to open, please append --m3u-extvlcopt to your command line." ); - } + else if( !b_enable_extvlcopt ) + { + msg_Err( p_demux, "m3u EXTVLCOPT parsing is disabled for security reasons. If you need it and trust the m3u playlist you are trying to open, please append --m3u-extvlcopt to your command line." ); + free( psz_option ); + } } } else if( !strncasecmp( psz_parse, "RTSPtext", sizeof("RTSPtext") -1 ) ) Index: include/vlc_input.h =================================================================== --- include/vlc_input.h (revision 23851) +++ include/vlc_input.h (working copy) @@ -728,6 +728,11 @@ }; /***************************************************************************** + * Otions + *****************************************************************************/ +VLC_EXPORT( vlc_bool_t, input_OptionIsSecure, ( const char * option ) ); + +/***************************************************************************** * Prototypes *****************************************************************************/ #define input_CreateThread(a,b) __input_CreateThread(VLC_OBJECT(a),b) Index: src/input/input.c =================================================================== --- src/input/input.c (revision 23851) +++ src/input/input.c (working copy) @@ -2965,3 +2965,43 @@ return VLC_TRUE; } + +/***************************************************************************** + * input_OptionIsSecure: Return if an option is secure or not + *****************************************************************************/ +static const char * secure_options_array[] = +{ + "ts-es-id-pid", + "no-video", + "audio-track-id" +}; + +vlc_bool_t input_OptionIsSecure( const char * option ) +{ + char buf[256]; + const char * psz; + int i, count = sizeof(secure_options_array)/sizeof(secure_options_array[0]); + + /* Strip out '=' and ' ' */ + if( strchr(psz, '=') || strchr(psz, ' ') ) + { + strncpy( buf, sizeof(buf), option ); + for( i = 0; i < strlen( buf ); i++ ) + { + if( buf[i] == '=' || strchr(psz, ' ') ) + buf[i] = 0; + } + psz = buf; + } + else + psz = option; + + /* FIXME: slow, use a vlc_dictionary_t */ + for( i = 0; i < count; i++ ) + { + if(!strcmp( psz, secure_options_array[i] ) + return VLC_TRUE; + } + return VLC_FALSE; +} +