[vlc-devel] [vlc-commits] input: readdir_helper: don't apply options on the current object

[Rémi Denis-Courmont]

Le 12 octobre 2017 14:45:23 GMT+03:00, Thomas Guillem <git at videolan.org> a écrit :
>vlc | branch: master | Thomas Guillem <thomas at gllm.fr> | Thu Oct 12
>10:41:44 2017 +0200| [6c87f601071d8ca1e9a321fd0a13824359e990a4] |
>committer: Thomas Guillem
>
>input: readdir_helper: don't apply options on the current object
>
>>
>http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=6c87f601071d8ca1e9a321fd0a13824359e990a4
>---
>
> src/input/item.c | 14 ++++++++++++--
> 1 file changed, 12 insertions(+), 2 deletions(-)
>
>diff --git a/src/input/item.c b/src/input/item.c
>index 187f633e3c..99cf6a2066 100644
>--- a/src/input/item.c
>+++ b/src/input/item.c
>@@ -1670,8 +1670,15 @@ void vlc_readdir_helper_init(struct
>vlc_readdir_helper *p_rdh,
>                        vlc_object_t *p_obj, input_item_node_t *p_node)
> {
> /* Read options from the parent item. This allows vlc_stream_ReadDir()
>-     * users to specify options whitout touching any vlc_object_t. */
>-    input_item_ApplyOptions(p_obj, p_node->p_item);
>+     * users to specify options whitout touhing any vlc_object_t.
>Apply options
>+     * on a temporary object in order to not apply options (that can
>be
>+     * insecure) to the current object. */
>+    vlc_object_t *p_var_obj = vlc_object_create(p_obj,
>sizeof(vlc_object_t));
>+    if (p_var_obj != NULL)
>+    {
>+        input_item_ApplyOptions(p_var_obj, p_node->p_item);
>+        p_obj = p_var_obj;
>+    }
> 
>     p_rdh->p_node = p_node;
>p_rdh->b_show_hiddenfiles = var_InheritBool(p_obj, "show-hiddenfiles");
>@@ -1681,6 +1688,9 @@ void vlc_readdir_helper_init(struct
>vlc_readdir_helper *p_rdh,
>         var_InheritInteger(p_obj, "sub-autodetect-fuzzy");
>     TAB_INIT(p_rdh->i_slaves, p_rdh->pp_slaves);
>     TAB_INIT(p_rdh->i_dirs, p_rdh->pp_dirs);
>+
>+    if (p_var_obj != NULL)
>+        vlc_object_release(p_var_obj);
> }
> 
>void vlc_readdir_helper_finish(struct vlc_readdir_helper *p_rdh, bool
>b_success)
>
>_______________________________________________
>vlc-commits mailing list
>vlc-commits at videolan.org
>https://mailman.videolan.org/listinfo/vlc-commits

The security issue and other unintended behaviours stem from copying parameters from the original input item to other items. I don't see how adding an intermediate temporary object solves much if anything at all.
-- 
Envoyé de mon appareil Android avec Courriel K-9 Mail. Veuillez excuser ma brièveté.