That could lead to a heap buffer overflow.
Thanks Andreas Fobian for the security report.
(cherry picked from commit 467b24dd0f9b0b3d8ba11dd813b393892f7f1ed2)
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
The function calling mms_ParsePacket() is expecting -1 (for error) or a
valid positive integer for success.
(cherry picked from commit f1e521b494bc87a254c6a6a47d27a528e35b5ca0)
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
RFC9110 specifies that a client must handle a shorter response range
than requested in all circumstanges. Previously, RFC7233 only required
that behaviour for multipart ranges, which VLC did not use.
This matches the newer specification: VLC will try to resume from the
last received offset not only on unexpected error, but also on short
response.
Fixes#28627.
(cherry picked from commit 90dc0a023f)
So that we don't have to include search.h each time vlc_fixups.h is used.
The Win32 prototype of lfind() expects an unsigned* for 'nelp', not a size_t*.
(cherry picked from commit 7c43bcba27)
Signed-off-by: Steve Lhomme <robux4@ycbcr.xyz>
MSVC doesn't have ssize_t but it has SSIZE_T which should be similar.
clang-cl doesn't have any ssize_t in its header and defines _MSC_VER so it
should work as well.
Co-authored-by: Martin Finkel <martin@videolabs.io>
Typos found and reworked from codespell.
(cherry picked from commit 6b7a57f984) (edited)
edited:
* some files don't exist in 3.0
* some 3.0 code around changes is different (vlc_tick_t)
Signed-off-by: Steve Lhomme <robux4@ycbcr.xyz>
While Darwin implements fstatvfs, the statvfs structures f_flag
field is only defined to contain two flags, ST_RDONLY and ST_NOSUID.
So the check for MNT_LOCAL would always be false, reporting all files
as non-local.
To mitigate that, on Darwin we can just use fstatfs and check
statfs.f_flags for MNT_LOCAL.
(cherry picked from commit 132ef66248)
Signed-off-by: Marvin Scholz <epirat07@gmail.com>
Since live555 2020.12.11, the API has changed. This should fix builds
with the latest version while still allowing contribs to pass.
Ref !1897.
Fixes#25473.
Co-authored-by: Dominic Mayers <dominic.mayers@meditationstudies.org>
Co-authored-by: Pei Jia <jiapei@longervision.com>
(cherry picked from commit 70fedf2523)
This reverts commit 205963ad09.
According to git blame on libsmb2, anonymous login was always enabled
with a NULL password.
I don't know what happened when I tested this reverted commit, I may
have mix up VLC or/and smb/smb2/dsm builds.
For future reference, see libsmb2/lib/ntlmssp.c:
...
encode_ntlm_auth(...)
{
...
if (auth_data->password == NULL) {
anonymous = 1;
goto encode;
}
...
}
Fixes#27113
Even if it is redundant with vlc_killed() (but not all APIs return
-EINTR when killed).
(cherry picked from commit 797e1f3b97)
Signed-off-by: Thomas Guillem <thomas@gllm.fr>
It was causing seek error when seeking past INT_MAX
Regression from c23709134c
(cherry picked from commit 9646722d61)
Signed-off-by: Thomas Guillem <thomas@gllm.fr>
Not sure when this regression happened on the libsmb2 side.
But setting the password to an empty string do enable anonymous login
now.
(cherry picked from commit 205963ad09)
Signed-off-by: Thomas Guillem <thomas@gllm.fr>
Errors can also be reported via generic cbs, that will cause the
vlc_smb2_mainloop to abort. In that case, we should destroy the smb2
context to fix the issue mentioned by 924c951518
(cherry picked from commit 960ef3f8ef)
Signed-off-by: Thomas Guillem <thomas@gllm.fr>
op->smb2 won't be used in case of error but it is cleaner like that.
(cherry picked from commit 5264a62539)
Signed-off-by: Thomas Guillem <thomas@gllm.fr>
No changes since this function is only checked for != 0 (for now).
(cherry picked from commit 0d51ab8a3e)
Signed-off-by: Thomas Guillem <thomas@gllm.fr>
If the smb2_timeout was valid, then not valid (infinite), the last value
was not taken into account.
(cherry picked from commit ac95bf19f9)
Signed-off-by: Thomas Guillem <thomas@gllm.fr>
If interrupted by the user, just close the connection whitout sending a
close request and don't save the context in the cache in that case.
(cherry picked from commit cf7d48cd02)
Signed-off-by: Thomas Guillem <thomas@gllm.fr>
This fixes a potential stack-buffer-overflow when destroying a context
from Close() if an operation was aborted. Indeed, the smb2_destroy()
function might trigger callbacks with private data that was allocated on
an old function stack. To fix this issue, always destroy the smb2
context immediately after an error (when the struct vlc_smb2_op is
valid).
This issue is currently hidden by the teardown mechanism (but still
possible), that always try to close gracefully in case of error.
(cherry picked from commit 924c951518)
Signed-off-by: Thomas Guillem <thomas@gllm.fr>
Thomas Guillem
Rémi Denis-Courmont
Craig Huggins
Johannes Kauffmann
Francois Cartegnie
Steve Lhomme
Alexandre Janniaux
KO Myung-Hun
Brad Smith
Romain Vimont
Marvin Scholz
Pierre Lamot
Jean-Baptiste Kempf