April 2022 - ffmpeg-cvslog - lists.ffmpeg.org

avcodec/pgxdec: Hoist branch out of loop
by Andreas Rheinhardt 27 Apr '22

27 Apr '22

ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> | Fri Apr 15 16:59:19 2022 +0200| [84a80ac15de802dfea32d83206deafadbd1947cb] | committer: Andreas Rheinhardt avcodec/pgxdec: Hoist branch out of loop Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=84a80ac15de802dfe… --- libavcodec/pgxdec.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/libavcodec/pgxdec.c b/libavcodec/pgxdec.c index 30895b51ee..29de103167 100644 --- a/libavcodec/pgxdec.c +++ b/libavcodec/pgxdec.c @@ -95,16 +95,13 @@ error: static inline void write_frame_ ##D(AVFrame *frame, GetByteContext *g, \ int width, int height, int sign, int depth) \ { \ + const unsigned offset = sign ? (1 << (D - 1)) : 0; \ int i, j; \ for (i = 0; i < height; i++) { \ PIXEL *line = (PIXEL*)(frame->data[0] + i * frame->linesize[0]); \ for (j = 0; j < width; j++) { \ - unsigned val; \ - if (sign) \ - val = (PIXEL)bytestream2_get_ ##suffix##u(g) + (1 << (depth - 1)); \ - else \ - val = bytestream2_get_ ##suffix##u(g); \ - val <<= (D - depth); \ + unsigned val = bytestream2_get_ ##suffix##u(g) << (D - depth); \ + val ^= offset; \ *(line + j) = val; \ } \ } \

1 0

avcodec/pgxdec: Fix issue with negative linesizes
by Andreas Rheinhardt 27 Apr '22

27 Apr '22

ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> | Fri Apr 15 16:05:20 2022 +0200| [e4a26a64a875d4376cd78f77905a58c4f0238d85] | committer: Andreas Rheinhardt avcodec/pgxdec: Fix issue with negative linesizes The PGX decoder accesses the lines via code like (PIXEL*)frame->data[0] + i*frame->linesize[0]/sizeof(PIXEL) where PIXEL is a macro parameter. This code has issues with negative linesizes, because the type of sizeof(PIXEL) is size_t, so that on common systems i*linesize/sizeof(PIXEL) will always be an unsigned type that is very large in case linesize is negative. This happens to work*, but it is undefined behaviour and e.g. leads to "src/libavcodec/pgxdec.c:114:1: runtime error: addition of unsigned offset to 0x7efe9c2b7040 overflowed to 0x7efe9c2b6040" errors from UBSAN. Fix this by using (PIXEL*)(frame->data[0] + i*frame->linesize[0]). This is allowed because linesize has to be suitably aligned. *: Converting a negative int to size_t works by adding SIZE_MAX + 1 to the number, so that the result is off by (SIZE_MAX + 1) / sizeof(PIXEL). Converting the pointer arithmetic (performed on PIXELs) back to ordinary pointers is tantamount to multiplying by sizeof(PIXEL), so that the result is off by SIZE_MAX + 1; but SIZE_MAX + 1 == 0 for the underlying pointers. Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e4a26a64a875d4376… --- libavcodec/pgxdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/pgxdec.c b/libavcodec/pgxdec.c index c9ada5afb5..30895b51ee 100644 --- a/libavcodec/pgxdec.c +++ b/libavcodec/pgxdec.c @@ -97,7 +97,7 @@ error: { \ int i, j; \ for (i = 0; i < height; i++) { \ - PIXEL *line = (PIXEL*)frame->data[0] + i*frame->linesize[0]/sizeof(PIXEL); \ + PIXEL *line = (PIXEL*)(frame->data[0] + i * frame->linesize[0]); \ for (j = 0; j < width; j++) { \ unsigned val; \ if (sign) \

1 0

avcodec/pgxdec: Remove pointless checks
by Andreas Rheinhardt 27 Apr '22

27 Apr '22

ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> | Fri Apr 15 14:11:19 2022 +0200| [67f796050519a3a3f1d52c6b054d3c80b8980cd2] | committer: Andreas Rheinhardt avcodec/pgxdec: Remove pointless checks These checks were (most likely) added to check for overreads as the bytestream2_get_* functions return 0 in this case. Yet this is not necessary anymore as we now have an explicit check for the size. Should the input contain a real \0, pgx_get_number() will error out lateron. Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=67f796050519a3a3f… --- libavcodec/pgxdec.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/libavcodec/pgxdec.c b/libavcodec/pgxdec.c index 9c474036da..c9ada5afb5 100644 --- a/libavcodec/pgxdec.c +++ b/libavcodec/pgxdec.c @@ -69,14 +69,11 @@ static int pgx_decode_header(AVCodecContext *avctx, GetByteContext *g, } else if (byte == '-') { *sign = 1; bytestream2_skipu(g, 1); - } else if (byte == 0) - goto error; + } byte = bytestream2_peek_byteu(g); if (byte == ' ') bytestream2_skipu(g, 1); - else if (byte == 0) - goto error; if (pgx_get_number(avctx, g, depth)) goto error;

1 0

avcodec/pgxdec: Avoid always-false checks
by Andreas Rheinhardt 27 Apr '22

27 Apr '22

ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> | Fri Apr 15 14:04:17 2022 +0200| [be6cd7dfd122cf7cd8841fd41d02067867f25898] | committer: Andreas Rheinhardt avcodec/pgxdec: Avoid always-false checks We have already checked that there is data to be read. Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=be6cd7dfd122cf7cd… --- libavcodec/pgxdec.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/libavcodec/pgxdec.c b/libavcodec/pgxdec.c index 154a683b4f..9c474036da 100644 --- a/libavcodec/pgxdec.c +++ b/libavcodec/pgxdec.c @@ -32,9 +32,9 @@ static int pgx_get_number(AVCodecContext *avctx, GetByteContext *g, int *number) *number = 0; while (1) { uint64_t temp; - if (!bytestream2_get_bytes_left(g)) + if (bytestream2_get_bytes_left(g) <= 0) return AVERROR_INVALIDDATA; - digit = bytestream2_get_byte(g); + digit = bytestream2_get_byteu(g); if (digit == ' ' || digit == 0xA || digit == 0xD) break; else if (digit < '0' || digit > '9') @@ -59,22 +59,22 @@ static int pgx_decode_header(AVCodecContext *avctx, GetByteContext *g, if (bytestream2_get_bytes_left(g) < 12) return AVERROR_INVALIDDATA; - bytestream2_skip(g, 6); + bytestream2_skipu(g, 6); // Is the component signed? - byte = bytestream2_peek_byte(g); + byte = bytestream2_peek_byteu(g); if (byte == '+') { *sign = 0; - bytestream2_skip(g, 1); + bytestream2_skipu(g, 1); } else if (byte == '-') { *sign = 1; - bytestream2_skip(g, 1); + bytestream2_skipu(g, 1); } else if (byte == 0) goto error; - byte = bytestream2_peek_byte(g); + byte = bytestream2_peek_byteu(g); if (byte == ' ') - bytestream2_skip(g, 1); + bytestream2_skipu(g, 1); else if (byte == 0) goto error; @@ -104,9 +104,9 @@ error: for (j = 0; j < width; j++) { \ unsigned val; \ if (sign) \ - val = (PIXEL)bytestream2_get_ ##suffix(g) + (1 << (depth - 1)); \ + val = (PIXEL)bytestream2_get_ ##suffix##u(g) + (1 << (depth - 1)); \ else \ - val = bytestream2_get_ ##suffix(g); \ + val = bytestream2_get_ ##suffix##u(g); \ val <<= (D - depth); \ *(line + j) = val; \ } \

1 0

avcodec/pgxdec: Make better use of size check
by Andreas Rheinhardt 27 Apr '22

27 Apr '22

ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> | Fri Apr 15 11:53:07 2022 +0200| [a7e8b0f360d0a7c84604e38759b24fa54e3349c7] | committer: Andreas Rheinhardt avcodec/pgxdec: Make better use of size check Each of the three calls to pgx_get_number() consumes at least two bytes. Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a7e8b0f360d0a7c84… --- libavcodec/pgxdec.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libavcodec/pgxdec.c b/libavcodec/pgxdec.c index 899e7a9994..154a683b4f 100644 --- a/libavcodec/pgxdec.c +++ b/libavcodec/pgxdec.c @@ -56,9 +56,8 @@ static int pgx_decode_header(AVCodecContext *avctx, GetByteContext *g, { int byte; - if (bytestream2_get_bytes_left(g) < 6) { + if (bytestream2_get_bytes_left(g) < 12) return AVERROR_INVALIDDATA; - } bytestream2_skip(g, 6);

1 0

[ffmpeg-web] branch master updated. 9749346 web/security: add some CVE#s
by ffmpeg-git＠ffmpeg.org 27 Apr '22

27 Apr '22

The branch, master has been updated via 9749346461f778cde41f7abceba50fdd359dd515 (commit) from 0d39e8111e34de45e8de7f09a851d9a247f6715e (commit) - Log ----------------------------------------------------------------- commit 9749346461f778cde41f7abceba50fdd359dd515 Author: Michael Niedermayer <michael(a)niedermayer.cc> AuthorDate: Wed Apr 27 21:58:56 2022 +0200 Commit: Michael Niedermayer <michael(a)niedermayer.cc> CommitDate: Wed Apr 27 21:58:56 2022 +0200 web/security: add some CVE#s diff --git a/src/security b/src/security index 5d8434c..d12eb57 100644 --- a/src/security +++ b/src/security @@ -1,5 +1,24 @@ <p>Please report vulnerabilities to <a href="mailto:ffmpeg-security@ffmpeg.org">ffmpeg-security(a)ffmpeg.org</a></p> +<h2>FFmpeg 5.0</h2> + +<h3>5.0</h3> +<p> +Fixes following vulnerabilities: +</p> +<pre> +CVE-2020-20446, 223b5e8ac9f6461bb13ed365419ec485c5b2b002 ticket/7995, +CVE-2020-20453, a7a7f32c8ad0179a1a85d0a8cff35924e6d90be8 ticket/8003, +CVE-2020-22015, 4c1afa292520329eecd1cc7631bc59a8cca95c46 ticket/8190, +CVE-2020-22019, 82ad1b76751bcfad5005440db48c46a4de5d6f02 CVE-2020-22033, ticket/8241,ticket/8246, +CVE-2020-22021, 7971f62120a55c141ec437aa3f0bacc1c1a3526b ticket/8240, +CVE-2020-22037, 7bba0dd6382e30d646cb406034a66199e071d713 ticket/8281, +CVE-2021-33815, 26d3c81bc5ef2f8c3f09d45eaeacfb4b1139a777 +CVE-2021-38114, 7150f9575671f898382c370acae35f9087a30ba1 +CVE-2021-38171, 9ffa49496d1aae4cbbb387aac28a9e061a6ab0a6 +CVE-2021-38291, e01d306c647b5827102260b885faa223b646d2d1 ticket/9312, +</pre> + <h2>FFmpeg 4.4</h2> <h3>4.4.1</h3> @@ -114,6 +133,14 @@ CVE-2020-22044, 1d479300cbe0522c233b7d51148aea2b29bd29ad, ticket/8295 <h2>FFmpeg 4.2</h2> +<h3>4.2.6</h3> +<p> +Fixes following vulnerabilities: +</p> +<pre> +CVE-2020-22027, 98981312e15ad6bf1c90e660abf666b15924e350 / e787f8fd7ee99ba0c3e0f086ce2ce59eea7ed86c, ticket/8242 +</pre> + <h3>4.2.5</h3> <p> Fixes following vulnerabilities: @@ -1065,6 +1092,19 @@ CVE-2016-7122, 1d90326f95a791db515f69a01a5f6ef867896d15 / e4e4a9cad7f21593d4bcb1 <h2>FFmpeg 2.8</h2> +<h3>2.8.18</h3> +<p> +Fixes following vulnerabilities: +</p> +<pre> +CVE-2020-20446, 287323027e0de523b12dca823c6cd5feef6569f7 / 223b5e8ac9f6461bb13ed365419ec485c5b2b002, ticket/7995 +CVE-2020-22021, bc5dde5ec0ba79860e566a44439ac72ae4a827f1 / 7971f62120a55c141ec437aa3f0bacc1c1a3526b, ticket/8240 +CVE-2020-22037, 9e84c17a43d84f4ba8e282f448dea04882b229cf / 7bba0dd6382e30d646cb406034a66199e071d713, ticket/8281 +CVE-2020-35965, 4371d51f1bdc92c4d2b159237b2d9c0a679151bb / 3e5959b3457f7f1856d997261e6ac672bba49e8b +CVE-2021-38114, c7b205dedd05a4983ab3ce557fdb06aa886127c9 / 7150f9575671f898382c370acae35f9087a30ba1 +CVE-2021-38171, a5f40432b4deeae9b371e5a2d4395343ffcfa359 / 9ffa49496d1aae4cbbb387aac28a9e061a6ab0a6 +</pre> + <h3>2.8.17</h3> <p> Fixes following vulnerabilities: ----------------------------------------------------------------------- Summary of changes: src/security | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) hooks/post-receive --

1 0

avfilter/af_anlms: add timeline support
by Paul B Mahol 27 Apr '22

27 Apr '22

ffmpeg | branch: master | Paul B Mahol <onemda(a)gmail.com> | Wed Apr 27 13:30:49 2022 +0200| [14b74610d7e6e471801fe755aa0840c9f2d4ecb4] | committer: Paul B Mahol avfilter/af_anlms: add timeline support > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=14b74610d7e6e4718… --- libavfilter/af_anlms.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/libavfilter/af_anlms.c b/libavfilter/af_anlms.c index 50bb0c7f42..6658cd2940 100644 --- a/libavfilter/af_anlms.c +++ b/libavfilter/af_anlms.c @@ -168,8 +168,11 @@ static int process_channels(AVFilterContext *ctx, void *arg, int jobnr, int nb_j int *offset = (int *)s->offset->extended_data[c]; float *output = (float *)out->extended_data[c]; - for (int n = 0; n < out->nb_samples; n++) + for (int n = 0; n < out->nb_samples; n++) { output[n] = process_sample(s, input[n], desired[n], delay, coeffs, tmp, offset); + if (ctx->is_disabled) + output[n] = input[n]; + } } return 0; @@ -314,7 +317,8 @@ const AVFilter ff_af_anlms = { FILTER_INPUTS(inputs), FILTER_OUTPUTS(outputs), FILTER_QUERY_FUNC(query_formats), - .flags = AVFILTER_FLAG_SLICE_THREADS, + .flags = AVFILTER_FLAG_SUPPORT_TIMELINE_INTERNAL | + AVFILTER_FLAG_SLICE_THREADS, .process_command = ff_filter_process_command, }; @@ -329,6 +333,7 @@ const AVFilter ff_af_anlmf = { FILTER_INPUTS(inputs), FILTER_OUTPUTS(outputs), FILTER_QUERY_FUNC(query_formats), - .flags = AVFILTER_FLAG_SLICE_THREADS, + .flags = AVFILTER_FLAG_SUPPORT_TIMELINE_INTERNAL | + AVFILTER_FLAG_SLICE_THREADS, .process_command = ff_filter_process_command, };

1 0

lavf/tls_mbedtls: add support for mbedtls version 3
by Timo Rothenpieler 27 Apr '22

27 Apr '22

ffmpeg | branch: release/4.1 | Timo Rothenpieler <timo(a)rothenpieler.org> | Sun Apr 24 01:02:14 2022 +0200| [456988fe2b8c3ff2a99575fbd5e1370d8edc991d] | committer: Timo Rothenpieler lavf/tls_mbedtls: add support for mbedtls version 3 - certs.h is gone. Only contains test data, and was not used at all. - config.h is renamed. Was seemingly not used, so can be removed. - MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE is gone, instead MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE will be thrown. - mbedtls_pk_parse_keyfile now needs to be passed a properly seeded RNG. Hence, move the call to after RNG seeding. Signed-off-by: Timo Rothenpieler <timo(a)rothenpieler.org> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=456988fe2b8c3ff2a… --- libavformat/tls_mbedtls.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/libavformat/tls_mbedtls.c b/libavformat/tls_mbedtls.c index 9b80a1e3c7..9f1679b15b 100644 --- a/libavformat/tls_mbedtls.c +++ b/libavformat/tls_mbedtls.c @@ -19,8 +19,7 @@ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ -#include <mbedtls/certs.h> -#include <mbedtls/config.h> +#include <mbedtls/version.h> #include <mbedtls/ctr_drbg.h> #include <mbedtls/entropy.h> #include <mbedtls/net_sockets.h> @@ -129,9 +128,15 @@ static void handle_pk_parse_error(URLContext *h, int ret) static void handle_handshake_error(URLContext *h, int ret) { switch (ret) { +#if MBEDTLS_VERSION_MAJOR < 3 case MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE: av_log(h, AV_LOG_ERROR, "None of the common ciphersuites is usable. Was the local certificate correctly set?\n"); break; +#else + case MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE: + av_log(h, AV_LOG_ERROR, "TLS handshake failed.\n"); + break; +#endif case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE: av_log(h, AV_LOG_ERROR, "A fatal alert message was received from the peer, has the peer a correct certificate?\n"); break; @@ -194,16 +199,6 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op } } - // load key file - if (shr->key_file) { - if ((ret = mbedtls_pk_parse_keyfile(&tls_ctx->priv_key, - shr->key_file, - tls_ctx->priv_key_pw)) != 0) { - handle_pk_parse_error(h, ret); - goto fail; - } - } - // seed the random number generator if ((ret = mbedtls_ctr_drbg_seed(&tls_ctx->ctr_drbg_context, mbedtls_entropy_func, @@ -213,6 +208,21 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op goto fail; } + // load key file + if (shr->key_file) { + if ((ret = mbedtls_pk_parse_keyfile(&tls_ctx->priv_key, + shr->key_file, + tls_ctx->priv_key_pw +#if MBEDTLS_VERSION_MAJOR >= 3 + , mbedtls_ctr_drbg_random, + &tls_ctx->ctr_drbg_context +#endif + )) != 0) { + handle_pk_parse_error(h, ret); + goto fail; + } + } + if ((ret = mbedtls_ssl_config_defaults(&tls_ctx->ssl_config, shr->listen ? MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM,

1 0

lavf/tls_mbedtls: add support for mbedtls version 3
by Timo Rothenpieler 27 Apr '22

27 Apr '22

ffmpeg | branch: release/4.2 | Timo Rothenpieler <timo(a)rothenpieler.org> | Sun Apr 24 01:02:14 2022 +0200| [43d68a07382469337e313e859da19b1fd060e83a] | committer: Timo Rothenpieler lavf/tls_mbedtls: add support for mbedtls version 3 - certs.h is gone. Only contains test data, and was not used at all. - config.h is renamed. Was seemingly not used, so can be removed. - MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE is gone, instead MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE will be thrown. - mbedtls_pk_parse_keyfile now needs to be passed a properly seeded RNG. Hence, move the call to after RNG seeding. Signed-off-by: Timo Rothenpieler <timo(a)rothenpieler.org> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=43d68a07382469337… --- libavformat/tls_mbedtls.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/libavformat/tls_mbedtls.c b/libavformat/tls_mbedtls.c index 9b80a1e3c7..9f1679b15b 100644 --- a/libavformat/tls_mbedtls.c +++ b/libavformat/tls_mbedtls.c @@ -19,8 +19,7 @@ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ -#include <mbedtls/certs.h> -#include <mbedtls/config.h> +#include <mbedtls/version.h> #include <mbedtls/ctr_drbg.h> #include <mbedtls/entropy.h> #include <mbedtls/net_sockets.h> @@ -129,9 +128,15 @@ static void handle_pk_parse_error(URLContext *h, int ret) static void handle_handshake_error(URLContext *h, int ret) { switch (ret) { +#if MBEDTLS_VERSION_MAJOR < 3 case MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE: av_log(h, AV_LOG_ERROR, "None of the common ciphersuites is usable. Was the local certificate correctly set?\n"); break; +#else + case MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE: + av_log(h, AV_LOG_ERROR, "TLS handshake failed.\n"); + break; +#endif case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE: av_log(h, AV_LOG_ERROR, "A fatal alert message was received from the peer, has the peer a correct certificate?\n"); break; @@ -194,16 +199,6 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op } } - // load key file - if (shr->key_file) { - if ((ret = mbedtls_pk_parse_keyfile(&tls_ctx->priv_key, - shr->key_file, - tls_ctx->priv_key_pw)) != 0) { - handle_pk_parse_error(h, ret); - goto fail; - } - } - // seed the random number generator if ((ret = mbedtls_ctr_drbg_seed(&tls_ctx->ctr_drbg_context, mbedtls_entropy_func, @@ -213,6 +208,21 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op goto fail; } + // load key file + if (shr->key_file) { + if ((ret = mbedtls_pk_parse_keyfile(&tls_ctx->priv_key, + shr->key_file, + tls_ctx->priv_key_pw +#if MBEDTLS_VERSION_MAJOR >= 3 + , mbedtls_ctr_drbg_random, + &tls_ctx->ctr_drbg_context +#endif + )) != 0) { + handle_pk_parse_error(h, ret); + goto fail; + } + } + if ((ret = mbedtls_ssl_config_defaults(&tls_ctx->ssl_config, shr->listen ? MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM,

1 0

lavf/tls_mbedtls: add support for mbedtls version 3
by Timo Rothenpieler 27 Apr '22

27 Apr '22

ffmpeg | branch: release/4.3 | Timo Rothenpieler <timo(a)rothenpieler.org> | Sun Apr 24 01:02:14 2022 +0200| [6ffc0e3198fdb219c5d4b2f841bc65e061cef24a] | committer: Timo Rothenpieler lavf/tls_mbedtls: add support for mbedtls version 3 - certs.h is gone. Only contains test data, and was not used at all. - config.h is renamed. Was seemingly not used, so can be removed. - MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE is gone, instead MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE will be thrown. - mbedtls_pk_parse_keyfile now needs to be passed a properly seeded RNG. Hence, move the call to after RNG seeding. Signed-off-by: Timo Rothenpieler <timo(a)rothenpieler.org> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6ffc0e3198fdb219c… --- libavformat/tls_mbedtls.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/libavformat/tls_mbedtls.c b/libavformat/tls_mbedtls.c index 965adf1be4..d718061ab9 100644 --- a/libavformat/tls_mbedtls.c +++ b/libavformat/tls_mbedtls.c @@ -19,8 +19,7 @@ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ -#include <mbedtls/certs.h> -#include <mbedtls/config.h> +#include <mbedtls/version.h> #include <mbedtls/ctr_drbg.h> #include <mbedtls/entropy.h> #include <mbedtls/net_sockets.h> @@ -130,9 +129,15 @@ static void handle_pk_parse_error(URLContext *h, int ret) static void handle_handshake_error(URLContext *h, int ret) { switch (ret) { +#if MBEDTLS_VERSION_MAJOR < 3 case MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE: av_log(h, AV_LOG_ERROR, "None of the common ciphersuites is usable. Was the local certificate correctly set?\n"); break; +#else + case MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE: + av_log(h, AV_LOG_ERROR, "TLS handshake failed.\n"); + break; +#endif case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE: av_log(h, AV_LOG_ERROR, "A fatal alert message was received from the peer, has the peer a correct certificate?\n"); break; @@ -195,16 +200,6 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op } } - // load key file - if (shr->key_file) { - if ((ret = mbedtls_pk_parse_keyfile(&tls_ctx->priv_key, - shr->key_file, - tls_ctx->priv_key_pw)) != 0) { - handle_pk_parse_error(h, ret); - goto fail; - } - } - // seed the random number generator if ((ret = mbedtls_ctr_drbg_seed(&tls_ctx->ctr_drbg_context, mbedtls_entropy_func, @@ -214,6 +209,21 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op goto fail; } + // load key file + if (shr->key_file) { + if ((ret = mbedtls_pk_parse_keyfile(&tls_ctx->priv_key, + shr->key_file, + tls_ctx->priv_key_pw +#if MBEDTLS_VERSION_MAJOR >= 3 + , mbedtls_ctr_drbg_random, + &tls_ctx->ctr_drbg_context +#endif + )) != 0) { + handle_pk_parse_error(h, ret); + goto fail; + } + } + if ((ret = mbedtls_ssl_config_defaults(&tls_ctx->ssl_config, shr->listen ? MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM,

1 0