GitLab

vlc security: As i've seen very little improvement on that front, i've decided to check in my take on handling the problem of managing harmful options. I'm pretty sure this is going to be very controversial, but I think my approach is quite simple and yet very effective Anyway, my approach makes the following assumptions:

- most vlc options are considered safe, only a handful are particularily unsafe and need be declared as such in their definition (they mostly deal with writing to an output file or URL)
- unsafe options are only considered potentially harmful when used as an input option, ie. the ':option' format. Configuration options are always considered safe 'i.e --option' 
- unsafe options are associated with a global security policy, which dictates how these are handled. At the moment, The policy can be either block, allow or prompt, and is set using the '--security-policy' option (which itself is considered unsafe ;)

the policy can be set by the user at the command line or in the preferences, it curently defaults to prompt, which is the desirable state for deskop use. However, it can be overriden depending on context, for example, the activex and mozilla will force the security-policy to block regardless of preference settins.

the code is a bit rough at the moment, but i will optimize/clean it up if the dev community this approach is worth keeping.

try the following example, and you'll see quickly what i mean:

./vlc -vvv <a mrl> :sout=#transcode{vcodec=mp1v,vb=1024,acodec=mpga,ab=192}:standard{mux=ts,dst=vlc-output.ts,access=file}"

Enjoy,
   Damien

* Headers in include must contain the structures and prototypes needed
  by the plugins and should be named vlc_*.
* Headers in include/vlc must contain the structures and prototypes
  needed by external libvlc clients

* Moved and renamed some things in headers. 
   - Removed vlc_cpu.h, vlc_error.h (merged in vlc_common)
   - Removed snapshot.h (merged in vlc_vout.h)
   - Removed vlc_spu.h (merged in vlc_osd.h)
   - Removed intf_eject.h and vlc_interaction.h (merged in vlc_interface)
   - Moved all internal headers to src
   - Merged vlc_video.h and video_output.h and move private things to src
   - Removed vlc/intf.h, vlc/aout.h, vlc/vout.h, vlc/decoder.h and vlc/input.h
     (meta headers for use in modules, and often implying too large 
     dependencies)
* Removed some useless dependencies
* Unexported a bunch of functions and structures used only in src/
  (--> Still some work here)
* Finally made input_thread_t and input_source_t (mostly) private. 
  Added input_GetItem to fetch the input_item of an input_thread
* Cleaned up deprecated entries in vlc_symbols.h and bumped up symbol 
  prefix

This commit has a 99% probability of breaking the build, 0.1% of killing
your cat and 0% of getting you hot chicks.

(da big courmischage)

* modules/demux/wav.c: started support for WAVEFORMATEXTENSIBLE (aka multichannel).
   support for float32 format.
* include/codecs.h: added WAVEFORMATEXTENSIBLE structure.
* modules/codec/araw.c: fixes.

* modules/codec/dts.c: fixes a buffer overflow with s/pdif.
* modules/access/cdda.c, modules/audio_output/file.c: endianness fixes for WAV header.

* modules/audio_output/file.c: added --audiofile-channels=integer option to specify the number of channels wanted in the output file.

* ALL: removed a bunch of unused add_category_hint().

sorry :)

(but as I'm too tired and it's apero time, round three
will follow later on in the night)

   String choices lists can now also have a list of text descriptions associated with them.
   Added integer choices lists.
* modules/gui/wxwindows/: modified config widgets to use the new config options.
* ALL: updated for the new config options.

    + Removed u8, s8, u16 etc. for good.
  * ALL:
    + Replaced all occurrences of u8, s8, u16 etc. with uint8_t, int8_t, etc.

* ALL: Capitalize all preferences text strings

* modules/audio_output/file.c: fixed a mismatch in a config name.

* modules/*: sanitization of the modules description strings.

* include/configuration.h: added the add_directory() config macro.
* modules/gui/wxwindows/preferences.cpp: support for add_string_from_list().
* ALL: changed some add_string() config options to add_file().

* Fix for the "lock-up" problem under MacOS X. Removed the rt-priority
  configuration variable.

indicate wether it is an "advanced" option or not. The goal with this is to
hide the user from all the strange options that very seldom needs to be
changed. added an extra argument to all the add_* macros to indicate wether
the item is advanced or not.
* src/libvlc.h: added an "show advanced options" config option default
disabled
* src/libvlc.c: the advanced options are not listed by vlc --help and
friends unless --advanced is used
* modules/gtk/preferences.c: the gtk/gnome preferences dialog don't show
advanced options unless advanced is set
all: set the advanced flag to VLC_FALSE or VLC_TRUE for all options, by
using some common sense. Please check and correct

note: All interfaces should still work like they used to, see the change in
modules/gtk/preferences.c to find out how to "hide" options.

second note: I think I've changed all the modules, but I could not test
everyone for compilation, expect some broken modules (the fix is to add ",
VLC_TRUE" as last argument to the add_* I forgot)

* Updated po files,
* New --buggy-psi options, to supports streams which don't update the
continuity counter in their PSI packets (walkenizes #sam).

* modules/audio_output/file.c: will write a WAV header by default. Can be
   disabled with --no-audiofile-wav.
* modules/audio_filter/resampler/linear.c: disabled for now, until I actually
   manage to make it work without a problem.

* include/vlc_threads.h: Avoid locking the interface,
* ALL: reworked all audio output plug-ins to correctly take into account
  i_channels. At present this is known to break OSS, probably others.

new ones.

* configure.in: Fixed a typo.

pf_setformat disappears (it was never called independantly of Open). If
the format needs to be changed, we will have Close/Open. This is much
simpler than before. Please check that I didn't break some plug-ins.