Fixes for CVE-2023-6602 broke my code

[2246c68]

I'm using ffmpeg to parse and mux a local M3U8 playlist, which looks like this:

$ cat /var/tmp/master.m3u8
#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:10
#EXT-X-MEDIA-SEQUENCE:0
#EXTINF:10.000000
/var/tmp/94905038906128.bin
#EXTINF:10.000000
/var/tmp/94905038923040.bin
#EXTINF:10.000000
/var/tmp/94905038933296.bin
...

Since the media segments are using a non-standard file extension (.bin), I used to manually whitelist it with av_dict_set(&options, "allowed_extensions", "bin", 0). This worked until 91d96dc8ddaebe0b6cb393f672085e6bfaf15a31 was implemented, which now seems to disable allowed_extensions by default and requires the user to set extension_picky to 0 to make allowed_extensions take effect again.

Is this really the intended behavior? I thought CVE fixes were not supposed to break code that does not exploit the vulnerability it refers to.

libavformat logs:

[hls @ 0x5653aabc5540] Skip ('#EXT-X-VERSION:3')
[hls @ 0x5653aabc5540] HLS request for url '/var/tmp/94917347047872.bin', offset 0, playlist 0
[hls @ 0x5653aabc5540] Opening '/var/tmp/94917347047872.bin' for reading
[hls @ 0x5653aabc5540] detected format mpegts extension none mismatches allowed extensions in url /var/tmp/94917347047872.bin
[hls @ 0x5653aabc5540] Error when loading first segment '/var/tmp/94917347047872.bin'
[AVIOContext @ 0x5653ab3c7610] Statistics: 32768 bytes read, 0 seeks
[AVIOContext @ 0x5653ab3d1770] Statistics: 3089 bytes read, 0 seeks

[MasterQuestionable]

#11435

[Michael Niedermayer]

Please provide a reproducable testcase, and please explain why "bin" is used as extension.