From 54d93f597d541db8cf2f1b24dffc94e937f24a6d Mon Sep 17 00:00:00 2001
From: Vincent Penquerc'h <vincent.penquerch@collabora.co.uk>
Date: Tue, 8 Sep 2015 14:00:54 +0100
Subject: [PATCH] mpdparser: forbid negative values for duration

https://bugzilla.gnome.org/show_bug.cgi?id=752492
---
 ext/dash/gstmpdparser.c | 29 +++++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/ext/dash/gstmpdparser.c b/ext/dash/gstmpdparser.c
index 059f1eaa66..3b153f758d 100644
--- a/ext/dash/gstmpdparser.c
+++ b/ext/dash/gstmpdparser.c
@@ -901,8 +901,9 @@ convert_to_millisecs (gint decimals, gint pos)
 }
 
 static gboolean
-gst_mpdparser_get_xml_prop_duration (xmlNode * a_node,
-    const gchar * property_name, gint64 default_value, gint64 * property_value)
+gst_mpdparser_get_xml_prop_duration_inner (xmlNode * a_node,
+    const gchar * property_name, gint64 default_value, gint64 * property_value,
+    gboolean allow_negative)
 {
   xmlChar *prop_string;
   gchar *str;
@@ -927,6 +928,10 @@ gst_mpdparser_get_xml_prop_duration (xmlNode * a_node,
         goto error;
       }
       GST_TRACE ("found - sign at the beginning");
+      if (!allow_negative) {
+        GST_WARNING ("sign \"-\" not allowed for property '%s'", property_name);
+        goto error;
+      }
       sign = -1;
       str++;
       len--;
@@ -1043,6 +1048,22 @@ error:
   return FALSE;
 }
 
+static gboolean
+gst_mpdparser_get_xml_prop_duration (xmlNode * a_node,
+    const gchar * property_name, gint64 default_value, gint64 * property_value)
+{
+  return gst_mpdparser_get_xml_prop_duration_inner (a_node, property_name,
+      default_value, property_value, TRUE);
+}
+
+static gboolean
+gst_mpdparser_get_xml_prop_duration_unsigned (xmlNode * a_node,
+    const gchar * property_name, gint64 default_value, gint64 * property_value)
+{
+  return gst_mpdparser_get_xml_prop_duration_inner (a_node, property_name,
+      default_value, property_value, FALSE);
+}
+
 static gboolean
 gst_mpdparser_get_xml_node_content (xmlNode * a_node, gchar ** content)
 {
@@ -2080,8 +2101,8 @@ gst_mpdparser_parse_root_node (GstMPDNode ** pointer, xmlNode * a_node)
       &new_mpd->minBufferTime);
   gst_mpdparser_get_xml_prop_duration (a_node, "timeShiftBufferDepth", -1,
       &new_mpd->timeShiftBufferDepth);
-  gst_mpdparser_get_xml_prop_duration (a_node, "suggestedPresentationDelay", -1,
-      &new_mpd->suggestedPresentationDelay);
+  gst_mpdparser_get_xml_prop_duration_unsigned (a_node,
+      "suggestedPresentationDelay", -1, &new_mpd->suggestedPresentationDelay);
   gst_mpdparser_get_xml_prop_duration (a_node, "maxSegmentDuration", -1,
       &new_mpd->maxSegmentDuration);
   gst_mpdparser_get_xml_prop_duration (a_node, "maxSubsegmentDuration", -1,