M3UParser: make url on demand

Bug: 77823362
Test: adb shell am start -a android.intent.action.VIEW -d http://10.42.0.1:8080
Change-Id: Ieaf8a13985277eee5b085ed243205a597627cf5e
(cherry picked from commit 26e236bd426770869644a9962778dedea7bf59be)
CVE-2018-9440

2 files changed, 22 insertions, 11 deletions

diff --git a/media/libstagefright/httplive/M3UParser.cpp b/media/libstagefright/httplive/M3UParser.cpp
index d07ffa3ec5..d79e24d23a 100644
--- a/media/libstagefright/httplive/M3UParser.cpp
+++ b/media/libstagefright/httplive/M3UParser.cpp
@@ -54,7 +54,7 @@ struct M3UParser::MediaGroup : public RefBase {
             const char *language,
             uint32_t flags);
 
-    bool getActiveURI(AString *uri) const;
+    bool getActiveURI(AString *uri, const char *baseURL) const;
 
     void pickRandomMediaItems();
     status_t selectTrack(size_t index, bool select);
@@ -70,6 +70,7 @@ private:
         AString mURI;
         AString mLanguage;
         uint32_t mFlags;
+        AString makeURL(const char *baseURL) const;
     };
 
     Type mType;
@@ -215,12 +216,12 @@ size_t M3UParser::MediaGroup::countTracks() const {
     return mMediaItems.size();
 }
 
-bool M3UParser::MediaGroup::getActiveURI(AString *uri) const {
+bool M3UParser::MediaGroup::getActiveURI(AString *uri, const char *baseURL) const {
     for (size_t i = 0; i < mMediaItems.size(); ++i) {
         if (mSelectedIndex >= 0 && i == (size_t)mSelectedIndex) {
             const Media &item = mMediaItems.itemAt(i);
 
-            *uri = item.mURI;
+            *uri = item.makeURL(baseURL);
             return true;
         }
     }
@@ -287,7 +288,7 @@ bool M3UParser::itemAt(size_t index, AString *uri, sp<AMessage> *meta) {
     }
 
     if (uri) {
-        *uri = mItems.itemAt(index).mURI;
+        *uri = mItems.itemAt(index).makeURL(mBaseURI.c_str());
     }
 
     if (meta) {
@@ -351,8 +352,7 @@ bool M3UParser::getTypeURI(size_t index, const char *key, AString *uri) const {
 
     AString groupID;
     if (!meta->findString(key, &groupID)) {
-        *uri = mItems.itemAt(index).mURI;
-
+        *uri = mItems.itemAt(index).makeURL(mBaseURI.c_str());
         AString codecs;
         if (!meta->findString("codecs", &codecs)) {
             // Assume media without any more specific attribute contains
@@ -378,7 +378,7 @@ bool M3UParser::getTypeURI(size_t index, const char *key, AString *uri) const {
     }
 
     sp<MediaGroup> group = mMediaGroups.valueFor(groupID);
-    if (!group->getActiveURI(uri)) {
+    if (!group->getActiveURI(uri, mBaseURI.c_str())) {
         return false;
     }
 
@@ -459,6 +459,18 @@ static bool MakeURL(const char *baseURL, const char *url, AString *out) {
     return true;
 }
 
+AString M3UParser::Item::makeURL(const char *baseURL) const {
+    AString out;
+    CHECK(MakeURL(baseURL, mURI.c_str(), &out));
+    return out;
+}
+
+AString M3UParser::MediaGroup::Media::makeURL(const char *baseURL) const {
+    AString out;
+    CHECK(MakeURL(baseURL, mURI.c_str(), &out));
+    return out;
+}
+
 status_t M3UParser::parse(const void *_data, size_t size) {
     int32_t lineNo = 0;
 
@@ -574,7 +586,7 @@ status_t M3UParser::parse(const void *_data, size_t size) {
             mItems.push();
             Item *item = &mItems.editItemAt(mItems.size() - 1);
 
-            CHECK(MakeURL(mBaseURI.c_str(), line.c_str(), &item->mURI));
+            item->mURI = line;
 
             item->mMeta = itemMeta;
 
@@ -1035,9 +1047,7 @@ status_t M3UParser::parseMedia(const AString &line) {
 
             AString tmp(val, 1, val.size() - 2);
 
-            if (!MakeURL(mBaseURI.c_str(), tmp.c_str(), &groupURI)) {
-                ALOGI("Failed to make absolute URI from '%s'.", tmp.c_str());
-            }
+            groupURI = tmp;
 
             haveGroupURI = true;
         }
diff --git a/media/libstagefright/httplive/M3UParser.h b/media/libstagefright/httplive/M3UParser.h
index ccd6556c7e..b1e0f1dd6d 100644
--- a/media/libstagefright/httplive/M3UParser.h
+++ b/media/libstagefright/httplive/M3UParser.h
@@ -56,6 +56,7 @@ private:
     struct Item {
         AString mURI;
         sp<AMessage> mMeta;
+        AString makeURL(const char *baseURL) const;
     };
 
     status_t mInitCheck;