From b2e689890f046d9679932347e08648b4bc2f3d93 Mon Sep 17 00:00:00 2001
From: Florin Apostol <florin.apostol@oregan.net>
Date: Wed, 16 Dec 2015 13:59:18 +0000
Subject: [PATCH] dashdemux: improve validation of UTCtiming element

gst_mpdparser_parse_utctiming_node does not validate the parsed values completely. The following scenarios are incorrectly accepted:
- elements with no schemeIdUri property should be rejected
- elements with unrecognized UTCTiming scheme should be rejected
- elements with empty values should be rejected

The last one triggers a division by 0 in gst_dash_demux_poll_clock_drift:
clock_drift->selected_url = clock_drift->selected_url % g_strv_length (urls);
because it urls is a valid pointer to an empty array.

https://bugzilla.gnome.org/show_bug.cgi?id=759547
---
 ext/dash/gstmpdparser.c         |  5 +++++
 tests/check/elements/dash_mpd.c | 43 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+)

diff --git a/ext/dash/gstmpdparser.c b/ext/dash/gstmpdparser.c
index ca52ebf..8510999 100644
--- a/ext/dash/gstmpdparser.c
+++ b/ext/dash/gstmpdparser.c
@@ -2207,6 +2207,11 @@ gst_mpdparser_parse_utctiming_node (GList ** list, xmlNode * a_node)
     }
     new_timing->urls = g_strsplit (value, " ", max_tokens);
     xmlFree (value);
+  }
+
+  /* append to list only if both method and urls were set */
+  if (new_timing->method != 0 && new_timing->urls != NULL &&
+      g_strv_length (new_timing->urls) != 0) {
     *list = g_list_append (*list, new_timing);
   } else {
     gst_mpdparser_free_utctiming_node (new_timing);
diff --git a/tests/check/elements/dash_mpd.c b/tests/check/elements/dash_mpd.c
index 9ba5b03..b460d14 100644
--- a/tests/check/elements/dash_mpd.c
+++ b/tests/check/elements/dash_mpd.c
@@ -2433,6 +2433,48 @@ GST_START_TEST (dash_mpdparser_utctiming)
       &selected_method);
   fail_if (urls == NULL);
   assert_equals_int (selected_method, GST_MPD_UTCTIMING_TYPE_HTTP_XSDATE);
+  urls =
+      gst_mpd_client_get_utc_timing_sources (mpdclient,
+      GST_MPD_UTCTIMING_TYPE_NTP, &selected_method);
+  fail_if (urls == NULL);
+  assert_equals_int (selected_method, GST_MPD_UTCTIMING_TYPE_NTP);
+  assert_equals_int (g_strv_length (urls), 4);
+  assert_equals_string (urls[0], "0.europe.pool.ntp.org");
+  assert_equals_string (urls[1], "1.europe.pool.ntp.org");
+  assert_equals_string (urls[2], "2.europe.pool.ntp.org");
+  assert_equals_string (urls[3], "3.europe.pool.ntp.org");
+  gst_mpd_client_free (mpdclient);
+}
+
+GST_END_TEST;
+
+/*
+ * Test parsing invalid UTCTiming values:
+ * - elements with no schemeIdUri property should be rejected
+ * - elements with no value property should be rejected
+ * - elements with unrecognised UTCTiming scheme should be rejected
+ * - elements with empty values should be rejected
+ *
+ */
+GST_START_TEST (dash_mpdparser_utctiming_invalid_value)
+{
+  const gchar *xml =
+      "<?xml version=\"1.0\"?>"
+      "<MPD xmlns=\"urn:mpeg:dash:schema:mpd:2011\""
+      " profiles=\"urn:mpeg:dash:profile:isoff-main:2011\">"
+      "<UTCTiming invalid_schemeIdUri=\"dummy.uri.scheme\" value=\"dummy value\"/>"
+      "<UTCTiming schemeIdUri=\"urn:mpeg:dash:utc:ntp:2014\" invalid_value=\"dummy value\"/>"
+      "<UTCTiming schemeIdUri=\"dummy.uri.scheme\" value=\"dummy value\"/>"
+      "<UTCTiming schemeIdUri=\"urn:mpeg:dash:utc:ntp:2014\" value=\"\"/>"
+      "</MPD>";
+  gboolean ret;
+  GstMpdClient *mpdclient = gst_mpd_client_new ();
+
+  ret = gst_mpd_parse (mpdclient, xml, (gint) strlen (xml));
+
+  assert_equals_int (ret, TRUE);
+  fail_if (mpdclient->mpd_node == NULL);
+  fail_if (mpdclient->mpd_node->UTCTiming != NULL);
   gst_mpd_client_free (mpdclient);
 }
 
@@ -5364,6 +5406,7 @@ dash_suite (void)
       dash_mpdparser_period_adaptationSet_representation_segmentTemplate);
   tcase_add_test (tc_simpleMPD, dash_mpdparser_period_subset);
   tcase_add_test (tc_simpleMPD, dash_mpdparser_utctiming);
+  tcase_add_test (tc_simpleMPD, dash_mpdparser_utctiming_invalid_value);
 
   /* tests checking other possible values for attributes */
   tcase_add_test (tc_simpleMPD, dash_mpdparser_type_dynamic);
-- 
2.7.4