PR #24567 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24567 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24567.patch
Found through reviews of last round >From af097d6061cb2c2982b0724396ef7d3da551caa6 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 19 Sep 2026 20:59:22 +0200 Subject: [PATCH 1/5] avformat/http: match cookie paths case-sensitively RFC 6265 section 5.1.4 --- libavformat/http.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/http.c b/libavformat/http.c index 686aa6b7b2..cc4bb606f8 100644 --- a/libavformat/http.c +++ b/libavformat/http.c @@ -1492,7 +1492,7 @@ static int get_cookies(HTTPContext *s, char **cookies, const char *path) e = av_dict_get(cookie_params, "path", NULL, 0); if (e) { size_t len = strlen(e->value); - if (av_strncasecmp(path, e->value, len) || + if (strncmp(path, e->value, len) || (len && path[len] && path[len] != '/' && path[len] != '?' && e->value[len - 1] != '/')) goto skip_cookie; -- 2.52.0 >From 83110cc419e2c60539c821247526276134fa8f74 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 19 Sep 2026 20:59:22 +0200 Subject: [PATCH 2/5] avformat/http: match cookie paths against the request path behind a proxy --- libavformat/http.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/http.c b/libavformat/http.c index cc4bb606f8..3abffdbca4 100644 --- a/libavformat/http.c +++ b/libavformat/http.c @@ -1730,7 +1730,7 @@ static int http_connect(URLContext *h, const char *path, const char *local_path, av_bprintf(&request, "Content-Type: %s\r\n", s->content_type); if (!has_header(s->headers, "\r\nCookie: ") && s->cookies) { char *cookies = NULL; - if (!get_cookies(s, &cookies, path) && cookies) { + if (!get_cookies(s, &cookies, local_path) && cookies) { av_bprintf(&request, "Cookie: %s\r\n", cookies); av_free(cookies); } -- 2.52.0 >From 311f6499f1e9bb05121d1a4c0a8952b7c10a7afa Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 19 Sep 2026 20:59:22 +0200 Subject: [PATCH 3/5] avformat/http: match cookie domains against IP addresses exactly RFC 6265 section 5.1.3 --- libavformat/http.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libavformat/http.c b/libavformat/http.c index 3abffdbca4..a09e4d6b0a 100644 --- a/libavformat/http.c +++ b/libavformat/http.c @@ -1111,12 +1111,17 @@ static const char *cookie_domain(const AVDictionary *cookie_params) return *domain ? domain : NULL; } +static int host_is_ip_literal(const char *host) +{ + return !host[strspn(host, "0123456789.")] || strchr(host, ':'); +} + static int host_in_cookie_domain(const char *host, const char *domain) { int offset = strlen(host) - strlen(domain); return offset >= 0 && !av_strcasecmp(host + offset, domain) && - (!offset || host[offset - 1] == '.'); + (!offset || (host[offset - 1] == '.' && !host_is_ip_literal(host))); } static int parse_cookie(HTTPContext *s, const char *p, const char *host, -- 2.52.0 >From 4f282259fd9a95e1b14898a0717b5e72c2f1fada Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 19 Sep 2026 20:59:22 +0200 Subject: [PATCH 4/5] avformat/http: keep cookie attributes that carry no value --- libavformat/http.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libavformat/http.c b/libavformat/http.c index a09e4d6b0a..d5764776f6 100644 --- a/libavformat/http.c +++ b/libavformat/http.c @@ -1092,7 +1092,7 @@ static int parse_set_cookie(const char *set_cookie, AVDictionary **dict) next_param = NULL; param += strspn(param, WHITESPACES); if ((name = av_strtok(param, "=", &value))) { - if (av_dict_set(dict, name, value, 0) < 0) { + if (av_dict_set(dict, name, value ? value : "", 0) < 0) { av_free(cstr); return -1; } @@ -1460,7 +1460,7 @@ static int get_cookies(HTTPContext *s, char **cookies, const char *path) while ((cookie = av_strtok(next, "\n", &saveptr)) && !ret) { AVDictionary *cookie_params = NULL; const AVDictionaryEntry *cookie_entry, *e; - const char *domain; + const char *domain, *eql; next = NULL; // store the cookie in a dict in case it is updated in the response @@ -1473,7 +1473,8 @@ static int get_cookies(HTTPContext *s, char **cookies, const char *path) // if the cookie has no value, skip it cookie_entry = av_dict_iterate(cookie_params, NULL); - if (!cookie_entry || !cookie_entry->value) + eql = strchr(cookie, '='); + if (!cookie_entry || !eql || memchr(cookie, ';', eql - cookie)) goto skip_cookie; // if the cookie has expired, don't add it -- 2.52.0 >From b1599633ec6a50bafeb8d9c652dd367cee867a68 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 19 Sep 2026 20:59:22 +0200 Subject: [PATCH 5/5] avformat/http: do not send Secure cookies over plain http --- libavformat/http.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/http.c b/libavformat/http.c index d5764776f6..f6e1ce9a85 100644 --- a/libavformat/http.c +++ b/libavformat/http.c @@ -1477,6 +1477,9 @@ static int get_cookies(HTTPContext *s, char **cookies, const char *path) if (!cookie_entry || !eql || memchr(cookie, ';', eql - cookie)) goto skip_cookie; + if (av_dict_get(cookie_params, "secure", NULL, 0) && !av_stristart(s->location, "https:", NULL)) + goto skip_cookie; + // if the cookie has expired, don't add it if ((e = av_dict_get(cookie_params, "expires", NULL, 0)) && e->value) { struct tm tm_buf = {0}; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
