external/srs
1
0
Fork 0
mirror of https://github.com/ossrs/srs.git synced 2025-02-13 11:51:57 +00:00
Code Issues Releases Wiki Activity

Fix command injection in api-server for HTTP callback. v5.0.157, v6.0.48

Browse source
This commit is contained in:
panda 2023-06-05 16:29:36 +08:00 committed by winlin
parent df854339ea
commit 1d878c2daa
4 changed files with 15 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
trunk/doc/CHANGELOG.md
View file

@ -8,6 +8,7 @@ The changelog for SRS.
## SRS 6.0 Changelog
* v6.0, 2023-06-05, Fix command injection in demonstration api-server for HTTP callback. v6.0.48
* v6.0, 2023-06-05, Merge [#3565](https://github.com/ossrs/srs/pull/3565): DTLS: Use bio callback to get fragment packet. v6.0.47 (#3565)
* v6.0, 2023-05-29, Merge [#3513](https://github.com/ossrs/srs/pull/3513): SSL: Fix SSL_get_error get the error of other coroutine. v6.0.46 (#3513)
* v6.0, 2023-05-14, Merge [#3534](https://github.com/ossrs/srs/pull/3534): Replace sprintf with snprintf to eliminate compile warnings. v6.0.45 (#3534)
@ -61,6 +62,7 @@ The changelog for SRS.
## SRS 5.0 Changelog
* v5.0, 2023-06-05, Fix command injection in demonstration api-server for HTTP callback. v5.0.157
* v5.0, 2023-06-05, Merge [#3565](https://github.com/ossrs/srs/pull/3565): DTLS: Use bio callback to get fragment packet. v5.0.156 (#3565)
* v5.0, 2023-05-29, Merge [#3513](https://github.com/ossrs/srs/pull/3513): SSL: Fix SSL_get_error get the error of other coroutine. v5.0.155 (#3513)
* v5.0, 2023-05-13, Merge [#3541](https://github.com/ossrs/srs/pull/3541): asan: Fix memory leak in asan by releasing global IPs when run_directly_or_daemon fails. v5.0.154 (#3541)

14
trunk/research/api-server/server.go
View file

@ -400,10 +400,18 @@ func (v *SnapshotJob) do(ffmpegPath, inputUrl string) (err error) {
normalPicPath := path.Join(outputPicDir, fmt.Sprintf("%v", v.Stream)+"-%03d.png")
bestPng := path.Join(outputPicDir, fmt.Sprintf("%v-best.png", v.Stream))
param := fmt.Sprintf("%v -i %v -vf fps=1 -vcodec png -f image2 -an -y -vframes %v -y %v", ffmpegPath, inputUrl, v.vframes, normalPicPath)
log.Println(fmt.Sprintf("start snapshot, cmd param=%v", param))
params := []string{
"-i", inputUrl,
"-vf", "fps=1",
"-vcodec", "png",
"-f", "image2",
"-an",
"-vframes", strconv.Itoa(v.vframes),
"-y", normalPicPath,
}
log.Println(fmt.Sprintf("start snapshot, cmd param=%v %v", ffmpegPath, strings.Join(params, " ")))
timeoutCtx, _ := context.WithTimeout(v.cancelCtx, v.timeout)
cmd := exec.CommandContext(timeoutCtx, "/bin/bash", "-c", param)
cmd := exec.CommandContext(timeoutCtx, ffmpegPath, params...)
if err = cmd.Run(); err != nil {
log.Println(fmt.Sprintf("run snapshot %v cmd failed, err is %v", v.Tag(), err))
return

2
trunk/src/core/srs_core_version5.hpp
View file

@ -9,6 +9,6 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 0
#define VERSION_REVISION 156
#define VERSION_REVISION 157
#endif

2
trunk/src/core/srs_core_version6.hpp
View file

@ -9,6 +9,6 @@
#define VERSION_MAJOR 6
#define VERSION_MINOR 0
#define VERSION_REVISION 47
#define VERSION_REVISION 48
#endif