gnu: mpv: Fix CVE-2018-6360.

* gnu/packages/patches/mpv-CVE-2018-6360-1.patch,
gnu/packages/patches/mpv-CVE-2018-6360-2.patch,
gnu/packages/patches/mpv-CVE-2018-6360-3.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
* gnu/packages/video.scm (mpv)[source]: Use them.

Signed-off-by: Leo Famulari <leo@famulari.name>

1 files changed, 138 insertions, 0 deletions

diff --git a/gnu/packages/patches/mpv-CVE-2018-6360-1.patch b/gnu/packages/patches/mpv-CVE-2018-6360-1.patch
new file mode 100644
index 0000000000..55fc7daaf3
--- /dev/null
+++ b/gnu/packages/patches/mpv-CVE-2018-6360-1.patch
@@ -0,0 +1,138 @@
+Fix CVE-2018-6360:
+
+https://github.com/mpv-player/mpv/issues/5456
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6360
+https://security-tracker.debian.org/tracker/CVE-2018-6360
+
+Patch copied from upstream source repository:
+
+https://github.com/mpv-player/mpv/commit/e6e6b0dcc7e9b0dbf35154a179b3dc1fcfcaff43
+
+To apply the patch to mpv 0.28.0 release tarball, hunk #4 is removed. Hunk #4
+checks if 'mpd_url' is safe, but the support for 'mpd_url' is not available
+for the 0.28.0 release. So it should be safe to remove hunk #4.
+
+From e6e6b0dcc7e9b0dbf35154a179b3dc1fcfcaff43 Mon Sep 17 00:00:00 2001
+From: Ricardo Constantino <wiiaboo@gmail.com>
+Date: Fri, 26 Jan 2018 01:19:04 +0000
+Subject: [PATCH] ytdl_hook: whitelist protocols from urls retrieved from
+ youtube-dl
+
+Not very clean since there's a lot of potential unsafe urls that youtube-dl
+can give us, depending on whether it's a single url, split tracks,
+playlists, segmented dash, etc.
+---
+ player/lua/ytdl_hook.lua | 54 +++++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 47 insertions(+), 7 deletions(-)
+
+diff --git a/player/lua/ytdl_hook.lua b/player/lua/ytdl_hook.lua
+index dd96ecc01d..b480c21625 100644
+--- a/player/lua/ytdl_hook.lua
++++ b/player/lua/ytdl_hook.lua
+@@ -16,6 +16,18 @@ local ytdl = {
+ 
+ local chapter_list = {}
+ 
++function Set (t)
++    local set = {}
++    for _, v in pairs(t) do set[v] = true end
++    return set
++end
++
++local safe_protos = Set {
++    "http", "https", "ftp", "ftps",
++    "rtmp", "rtmps", "rtmpe", "rtmpt", "rtmpts", "rtmpte",
++    "data"
++}
++
+ local function exec(args)
+     local ret = utils.subprocess({args = args})
+     return ret.status, ret.stdout, ret
+@@ -183,6 +195,9 @@ local function edl_track_joined(fragments, protocol, is_live, base)
+ 
+     for i = offset, #fragments do
+         local fragment = fragments[i]
++        if not url_is_safe(join_url(base, fragment)) then
++            return nil
++        end
+         table.insert(parts, edl_escape(join_url(base, fragment)))
+         if fragment.duration then
+             parts[#parts] =
+@@ -208,6 +223,15 @@ local function proto_is_dash(json)
+            or json["protocol"] == "http_dash_segments"
+ end
+ 
++local function url_is_safe(url)
++    local proto = type(url) == "string" and url:match("^(.+)://") or nil
++    local safe = proto and safe_protos[proto]
++    if not safe then
++        msg.error(("Ignoring potentially unsafe url: '%s'"):format(url))
++    end
++    return safe
++end
++
+ local function add_single_video(json)
+     local streamurl = ""
+     local max_bitrate = 0
+@@ -238,14 +264,18 @@ local function add_single_video(json)
+             edl_track = edl_track_joined(track.fragments,
+                 track.protocol, json.is_live,
+                 track.fragment_base_url)
++            local url = edl_track or track.url
++            if not url_is_safe(url) then
++                return
++            end
+             if track.acodec and track.acodec ~= "none" then
+                 -- audio track
+                 mp.commandv("audio-add",
+-                    edl_track or track.url, "auto",
++                    url, "auto",
+                     track.format_note or "")
+             elseif track.vcodec and track.vcodec ~= "none" then
+                 -- video track
+-                streamurl = edl_track or track.url
++                streamurl = url
+             end
+         end
+ 
+@@ -264,7 +294,13 @@ local function add_single_video(json)
+ 
+     msg.debug("streamurl: " .. streamurl)
+ 
+-    mp.set_property("stream-open-filename", streamurl:gsub("^data:", "data://", 1))
++    streamurl = streamurl:gsub("^data:", "data://", 1)
++
++    if not url_is_safe(streamurl) then
++        return
++    end
++
++    mp.set_property("stream-open-filename", streamurl)
+ 
+     mp.set_property("file-local-options/force-media-title", json.title)
+ 
+@@ -526,14 +562,18 @@ mp.add_hook(o.try_ytdl_first and "on_load" or "on_load_fail", 10, function ()
+                         site = entry["webpage_url"]
+                     end
+ 
+-                    if not (site:find("https?://") == 1) then
+-                        site = "ytdl://" .. site
++                    -- links with only youtube id as returned by --flat-playlist
++                    if not site:find("://") then
++                        table.insert(playlist, "ytdl://" .. site)
++                    elseif url_is_safe(site) then
++                        table.insert(playlist, site)
+                     end
+-                    table.insert(playlist, site)
+ 
+                 end
+ 
+-                mp.set_property("stream-open-filename", "memory://" .. table.concat(playlist, "\n"))
++                if #playlist > 0 then
++                    mp.set_property("stream-open-filename", "memory://" .. table.concat(playlist, "\n"))
++                end
+             end
+ 
+         else -- probably a video
+-- 
+2.16.1
+