PR #24418 opened by mirco URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24418 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24418.patch
mbedTLS's version module (MBEDTLS_VERSION_C) is optional and distributions building a size-optimised mbedTLS leave it out; mbedtls/version.h then does not declare mbedtls_version_get_number() and the unconditional call in tls_open() fails to compile: libavformat/tls_mbedtls.c:637:9: error: implicit declaration of function 'mbedtls_version_get_number' The call only exists to detect mbedTLS 3.6.0, whose TLS 1.3 code cannot disable certificate verification. Query the version at runtime when the module is available and fall back to the compile-time MBEDTLS_VERSION_NUMBER otherwise; the two only differ when the headers do not match the library. Signed-off-by: Mirko Vogt <[email protected]> >From 46ec9d1b03958dd0594dfdaa7f765309454051a3 Mon Sep 17 00:00:00 2001 From: Mirko Vogt <[email protected]> Date: Tue, 8 Sep 2026 12:00:00 +0000 Subject: [PATCH] avformat/tls_mbedtls: build without mbedTLS's version module mbedTLS's version module (MBEDTLS_VERSION_C) is optional and distributions building a size-optimised mbedTLS leave it out; mbedtls/version.h then does not declare mbedtls_version_get_number() and the unconditional call in tls_open() fails to compile: libavformat/tls_mbedtls.c:637:9: error: implicit declaration of function 'mbedtls_version_get_number' The call only exists to detect mbedTLS 3.6.0, whose TLS 1.3 code cannot disable certificate verification. Query the version at runtime when the module is available and fall back to the compile-time MBEDTLS_VERSION_NUMBER otherwise; the two only differ when the headers do not match the library. Signed-off-by: Mirko Vogt <[email protected]> --- libavformat/tls_mbedtls.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/libavformat/tls_mbedtls.c b/libavformat/tls_mbedtls.c index 8f7ace5e63..f7e9d60d66 100644 --- a/libavformat/tls_mbedtls.c +++ b/libavformat/tls_mbedtls.c @@ -44,6 +44,16 @@ #include "libavutil/avstring.h" #include "libavutil/random_seed.h" +/* The version module is optional in mbedTLS (MBEDTLS_VERSION_C). */ +static unsigned int tls_mbedtls_version_number(void) +{ +#if defined(MBEDTLS_VERSION_C) + return mbedtls_version_get_number(); +#else + return MBEDTLS_VERSION_NUMBER; +#endif +} + static int mbedtls_x509_fingerprint(char *cert_buf, size_t cert_sz, char **fingerprint) { unsigned char md[32]; @@ -634,7 +644,7 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op #ifdef MBEDTLS_SSL_PROTO_TLS1_3 // this version does not allow disabling certificate verification with TLSv1.3 (yes, really). - if (mbedtls_version_get_number() == 0x03060000 && !shr->verify) { + if (tls_mbedtls_version_number() == 0x03060000 && !shr->verify) { av_log(h, AV_LOG_INFO, "Forcing TLSv1.2 because certificate verification is disabled\n"); mbedtls_ssl_conf_max_tls_version(&tls_ctx->ssl_config, MBEDTLS_SSL_VERSION_TLS1_2); } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
