oysteikt/mpd
0
0
Fork 0
Code Issues Pull Requests Releases Activity
music player daemon (fork)
1,673 Commits 1 Branch 144 Tags 56 MiB
C++ 94.4%
Meson 2.8%
Python 1.4%
Java 0.6%
Kotlin 0.5%
Other 0.2%
29df70366c
Go to file
Eric Wong 29df70366c storedPlaylist: prevent potential DoS from stored playlist commands 
While mpd has always protected against the infinite expansion of
the main playlist by limiting its size in memory, however the
new storedPlaylist code has never checked for this limit.

Malicious (or clumsy) users could repeatedly append songs to
stored playlists, causing files to grow increasingly large
on disk.  Attempting to load extremely large files into memory
will require mpd to slurp that all into memory, and ultimately
the file would be unusable by mpd because of the configurable
playlist size limit.

Now we limit stored playlists to the max_playlist_length
configuration variable set by the user (default is 16384).  We
will refuse to append to playlist files if they hit that limit;
and also refuse to load more than the specified amount of songs
into memory.

git-svn-id: https://svn.musicpd.org/mpd/trunk@7154 09075e82-0dd4-0310-85a5-a0d7c8717e4f
2008-01-26 20:20:59 +00:00
doc Adding FIFO audio output. This is pretty much identical to the old one, 2007-06-13 14:15:30 +00:00
m4 Updating libFLAC.m4 so that -L isn't erroneously specified without an 2007-05-28 13:01:08 +00:00
scripts scripts/mpd-indent.sh: fixup goto label indentation 2007-12-16 21:47:48 +00:00
src storedPlaylist: prevent potential DoS from stored playlist commands 2008-01-26 20:20:59 +00:00
AUTHORS Updating Kodest's name/email. 2007-06-25 12:13:45 +00:00
autogen.sh Use POSIX compatible tr arguments in autogen.sh 2007-11-16 04:05:53 +00:00
ChangeLog ChangeLog: adding LAME tag ReplayGain 2007-08-25 17:02:41 +00:00
configure.ac Check for pkg-config unconditionally. It might not be needed if we disable 2007-06-24 21:31:08 +00:00
COPYING import from SF CVS 2004-02-23 23:41:20 +00:00
INSTALL Updating INSTALL. 2007-05-27 13:38:52 +00:00
Makefile.am Merge branches/ew r7104 2007-12-28 02:56:25 +00:00
README Doc updates for 0.13.0 2007-03-31 15:20:39 +00:00
TODO Moving 0.13 tasks to 0.14 in TODO. 2007-05-27 13:15:12 +00:00
UPGRADING Updating UPGRADING. 2007-05-27 13:30:46 +00:00

README 

                       Music Player Daemon (MPD)
                        http://www.musicpd.org

A daemon for playing music of various formats.  Music is played through the 
server's audio device.  The daemon stores info about all available music, 
and this info can be easily searched and retrieved.  Player control, info
retrieval, and playlist management can all be managed remotely.

To install MPD, see INSTALL.

MPD includes mp4ff in the source, due to licensing issues of the newer 
version and includes bugfixes with the properly licensed version.  mp4ff is 
released under the GPL and copyrighted by M. Bakker, Ahead Software AG 
(http://www.nero.com) and is distributed as a part of the FAAD2 - Freeware 
Advance Audio (AAC) Decoder.

MPD is released under the GNU Public License.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
For the full license, see COPYING.