Changeset 05c8198d0fb455cac11022f0a5e483729b02a7ee

Timestamp:

11/20/07 19:54:04 (10 months ago)

Author:

Rémi Denis-Courmont <rem@videolan.org>

git-committer:

Rémi Denis-Courmont <rem@videolan.org> 1195584844 +0000

git-parent:

[b83bd217a9bdb163c50bb60aec1007113e5f11a1]

git-author:

Rémi Denis-Courmont <rem@videolan.org> 1195584844 +0000

Message:

Remove VLCOPT support from M3U parser.
This was blatantly insecure.

Files:

• modules/demux/playlist/m3u.c (modified) (2 diffs)

modules/demux/playlist/m3u.c

@@ -146 +146 @@
-                    psz_artist = strdup( psz_artist );
-            }
+#if 0
+            /* You're going to need a pretty strong explanation, why
+             * this is not a big security hole if you are to uncomment
+             * this piece of code. Potentially untrusted input file must
+             * not be allowed to specify options in an open-handed fashion.
+             * -- Courmisch
+             */
-            else if( !strncasecmp( psz_parse, "EXTVLCOPT:",
-                                   sizeof("EXTVLCOPT:") -1 ) )
@@ -159 +166 @@
-                                 psz_option );
-            }
+#endif
-        }
-        else if( !strncasecmp( psz_parse, "RTSPtext", sizeof("RTSPtext") -1 ) )