input: fix stack overflow if user feeds an overly large MRL

[vlc] / src / input / input.c

diff --git a/src/input/input.c b/src/input/input.c
index bdf91af2bceadf26fbf01a36793504aaa64167a1..94b1d766bc5163f1369539e213bca75aaeff8b2b 100644 (file)
--- a/src/input/input.c
+++ b/src/input/input.c
@@ -121,7 +121,6 @@ static input_thread_t *Create( vlc_object_t *p_parent, input_item_t *p_item,
 {
     static const char input_name[] = "input";
     input_thread_t *p_input = NULL;                 /* thread descriptor */
-    vlc_value_t val;
     int i;
 
     /* Allocate descriptor */
@@ -210,6 +209,7 @@ static input_thread_t *Create( vlc_object_t *p_parent, input_item_t *p_item,
     vlc_mutex_init( &p_input->p->lock_control );
     vlc_cond_init( &p_input->p->wait_control );
     p_input->p->i_control = 0;
+    p_input->p->b_abort = false;
 
     /* Parse input options */
     vlc_mutex_lock( &p_item->lock );
@@ -228,12 +228,12 @@ static input_thread_t *Create( vlc_object_t *p_parent, input_item_t *p_item,
     /* */
     if( !p_input->b_preparsing )
     {
-        var_Get( p_input, "bookmarks", &val );
-        if( val.psz_string )
+        char *psz_bookmarks = var_GetNonEmptyString( p_input, "bookmarks" );
+        if( psz_bookmarks )
         {
             /* FIXME: have a common cfg parsing routine used by sout and others */
             char *psz_parser, *psz_start, *psz_end;
-            psz_parser = val.psz_string;
+            psz_parser = psz_bookmarks;
             while( (psz_start = strchr( psz_parser, '{' ) ) )
             {
                  seekpoint_t *p_seekpoint;
@@ -272,7 +272,7 @@ static input_thread_t *Create( vlc_object_t *p_parent, input_item_t *p_item,
                 vlc_seekpoint_Delete( p_seekpoint );
                 *psz_parser = backup;
             }
-            free( val.psz_string );
+            free( psz_bookmarks );
         }
     }
 
@@ -430,13 +430,17 @@ int input_Preparse( vlc_object_t *p_parent, input_item_t *p_item )
  *
  * \param the input thread to stop
  */
-void input_StopThread( input_thread_t *p_input )
+void input_StopThread( input_thread_t *p_input, bool b_abort )
 {
     /* Set die for input and ALL of this childrens (even (grand-)grand-childrens)
      * It is needed here even if it is done in INPUT_CONTROL_SET_DIE handler to
      * unlock the control loop */
     ObjectKillChildrens( p_input, VLC_OBJECT(p_input) );
 
+    vlc_mutex_lock( &p_input->p->lock_control );
+    p_input->p->b_abort |= b_abort;
+    vlc_mutex_unlock( &p_input->p->lock_control );
+
     input_ControlPush( p_input, INPUT_CONTROL_SET_DIE, NULL );
 }
 
@@ -507,7 +511,14 @@ static void *Run( vlc_object_t *p_this )
 
 exit:
     /* Tell we're dead */
+    vlc_mutex_lock( &p_input->p->lock_control );
+    const bool b_abort = p_input->p->b_abort;
+    vlc_mutex_unlock( &p_input->p->lock_control );
+
+    if( b_abort )
+        input_SendEventAbort( p_input );
     input_SendEventDead( p_input );
+
     vlc_restorecancel( canc );
     return NULL;
 }
@@ -582,10 +593,8 @@ static void MainLoopDemux( input_thread_t *p_input, bool *pb_changed, mtime_t *p
 
     if( i_ret == 0 )    /* EOF */
     {
-        vlc_value_t repeat;
-
-        var_Get( p_input, "input-repeat", &repeat );
-        if( repeat.i_int == 0 )
+        int i_repeat = var_GetInteger( p_input, "input-repeat" );
+        if( i_repeat == 0 )
         {
             /* End of file - we do not set b_die because only the
              * playlist is allowed to do so. */
@@ -596,12 +605,11 @@ static void MainLoopDemux( input_thread_t *p_input, bool *pb_changed, mtime_t *p
         {
             vlc_value_t val;
 
-            msg_Dbg( p_input, "repeating the same input (%d)",
-                     repeat.i_int );
-            if( repeat.i_int > 0 )
+            msg_Dbg( p_input, "repeating the same input (%d)", i_repeat );
+            if( i_repeat > 0 )
             {
-                repeat.i_int--;
-                var_Set( p_input, "input-repeat", repeat );
+                i_repeat--;
+                var_SetInteger( p_input, "input-repeat", i_repeat );
             }
 
             /* Seek to start title/seekpoint */
@@ -1063,8 +1071,7 @@ static void InitPrograms( input_thread_t * p_input )
     val.p_list = NULL;
     if( p_input->p->p_sout )
     {
-        var_Get( p_input, "sout-all", &val );
-        if( val.b_bool )
+        if( var_GetBool( p_input, "sout-all" ) )
         {
             i_es_out_mode = ES_OUT_MODE_ALL;
             val.p_list = NULL;
@@ -1237,6 +1244,8 @@ error_stats:
         EXIT_COUNTER( demux_read );
         EXIT_COUNTER( input_bitrate );
         EXIT_COUNTER( demux_bitrate );
+        EXIT_COUNTER( demux_corrupted );
+        EXIT_COUNTER( demux_discontinuity );
         EXIT_COUNTER( played_abuffers );
         EXIT_COUNTER( lost_abuffers );
         EXIT_COUNTER( displayed_pictures );
@@ -1311,6 +1320,8 @@ static void End( input_thread_t * p_input )
             CL_CO( demux_read );
             CL_CO( input_bitrate );
             CL_CO( demux_bitrate );
+            CL_CO( demux_corrupted );
+            CL_CO( demux_discontinuity );
             CL_CO( played_abuffers );
             CL_CO( lost_abuffers );
             CL_CO( displayed_pictures );
@@ -2265,14 +2276,15 @@ static int InputSourceInit( input_thread_t *p_input,
                             input_source_t *in, const char *psz_mrl,
                             const char *psz_forced_demux )
 {
-    char psz_dup[strlen(psz_mrl) + 1];
     const char *psz_access;
     const char *psz_demux;
     char *psz_path;
-    vlc_value_t val;
     double f_fps;
 
-    strcpy( psz_dup, psz_mrl );
+    char *psz_dup = strdup( psz_mrl );
+
+    if( psz_dup == NULL )
+        goto error;
 
     /* Split uri */
     input_SplitMRL( &psz_access, &psz_demux, &psz_path, psz_dup );
@@ -2365,11 +2377,10 @@ static int InputSourceInit( input_thread_t *p_input,
         var_SetBool( p_input, "can-rate", !in->b_can_pace_control || in->b_can_rate_control ); /* XXX temporary because of es_out_timeshift*/
         var_SetBool( p_input, "can-rewind", !in->b_rescale_ts && !in->b_can_pace_control );
 
-        int ret = demux_Control( in->p_demux, DEMUX_CAN_SEEK,
-                        &val.b_bool );
-        if( ret != VLC_SUCCESS )
-            val.b_bool = false;
-        var_Set( p_input, "can-seek", val );
+        bool b_can_seek;
+        if( demux_Control( in->p_demux, DEMUX_CAN_SEEK, &b_can_seek ) )
+            b_can_seek = false;
+        var_SetBool( p_input, "can-seek", b_can_seek );
     }
     else
     {
@@ -2544,6 +2555,8 @@ static int InputSourceInit( input_thread_t *p_input,
         }
     }
 
+    free( psz_dup );
+
     /* Set record capabilities */
     if( demux_Control( in->p_demux, DEMUX_CAN_RECORD, &in->b_can_stream_record ) )
         in->b_can_stream_record = false;
@@ -2591,6 +2604,7 @@ error:
 
     if( in->p_access )
         access_Delete( in->p_access );
+    free( psz_dup );
 
     return VLC_EGENERIC;
 }
@@ -2756,14 +2770,12 @@ static void SlaveSeek( input_thread_t *p_input )
  *****************************************************************************/
 static void InputMetaUser( input_thread_t *p_input, vlc_meta_t *p_meta )
 {
-    vlc_value_t val;
-
     /* Get meta information from user */
 #define GET_META( field, s ) do { \
-    var_Get( p_input, (s), &val );  \
-    if( val.psz_string && *val.psz_string ) \
-        vlc_meta_Set( p_meta, vlc_meta_ ## field, val.psz_string ); \
-    free( val.psz_string ); } while(0)
+    char *psz_string = var_GetNonEmptyString( p_input, (s) );  \
+    if( psz_string ) \
+        vlc_meta_Set( p_meta, vlc_meta_ ## field, psz_string ); \
+    free( psz_string ); } while(0)
 
     GET_META( Title, "meta-title" );
     GET_META( Artist, "meta-artist" );