Dash demuxer segfault

[Detergent]

Summary of the bug:
How to reproduce:

% ffmpeg -i http://download.tsi.telecom-paristech.fr/gpac/dataset/dash/uhd/dashevc-main-6s/dashevc-main-6s.mpd
ffmpeg version N-87286-g6ce4a635ed Copyright (c) 2000-2017 the FFmpeg developers
  built with gcc 5.4.0 (Ubuntu 5.4.0-6ubuntu1~16.04.4) 20160609
  configuration: --enable-gpl --enable-nonfree --enable-libx264 --enable-libopus --enable-shared --enable-libcaca --enable-openssl --enable-libxml2
  libavutil      55. 74.100 / 55. 74.100
  libavcodec     57.105.100 / 57.105.100
  libavformat    57. 82.100 / 57. 82.100
  libavdevice    57.  8.100 / 57.  8.100
  libavfilter     6.105.100 /  6.105.100
  libswscale      4.  7.103 /  4.  7.103
  libswresample   2.  8.100 /  2.  8.100
  libpostproc    54.  6.100 / 54.  6.100
[2]    26794 segmentation fault (core dumped)  ffmpeg -i 

Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00007fbf08d83ce3 in ff_dash_fill_tmpl_params (dst=dst@entry=0x7fffffffb7b0 " ", 
    buffer_size=buffer_size@entry=4096, template=0x0, rep_id=rep_id@entry=0, number=0, 
    bit_rate=bit_rate@entry=0, time=0) at libavformat/dash.c:102
102	    while (dst_pos < buffer_size - 1 && *t_cur) {
(gdb) bt
#0  0x00007fbf08d83ce3 in ff_dash_fill_tmpl_params (dst=dst@entry=0x7fffffffb7b0 " ", 
    buffer_size=buffer_size@entry=4096, template=0x0, rep_id=rep_id@entry=0, number=0, 
    bit_rate=bit_rate@entry=0, time=0) at libavformat/dash.c:102
#1  0x00007fbf08d87c5d in get_current_fragment (pls=pls@entry=0x66e6e0)
    at libavformat/dashdec.c:1253
#2  0x00007fbf08d87f24 in read_data (opaque=0x66e6e0, buf=0x67e060 "Ȓ\030\006\277\177", 
    buf_size=32768) at libavformat/dashdec.c:1406
#3  0x00007fbf08d78157 in fill_buffer (s=0x66e6e8) at libavformat/aviobuf.c:573
#4  avio_read (s=s@entry=0x66e6e8, buf=0x66ef00 "\270\222\030\006\277\177", 
    size=size@entry=2048) at libavformat/aviobuf.c:667
#5  0x00007fbf08da1ed3 in av_probe_input_buffer2 (pb=pb@entry=0x66e6e8, 
    fmt=fmt@entry=0x7fffffffc968, filename=filename@entry=0x7fbf08ee021c "", 
    logctx=logctx@entry=0x0, offset=offset@entry=0, max_probe_size=1048576, 
    max_probe_size@entry=0) at libavformat/format.c:314
#6  0x00007fbf08da20e9 in av_probe_input_buffer (pb=pb@entry=0x66e6e8, 
    fmt=fmt@entry=0x7fffffffc968, filename=filename@entry=0x7fbf08ee021c "", 
    logctx=logctx@entry=0x0, offset=offset@entry=0, max_probe_size=max_probe_size@entry=0)
    at libavformat/format.c:368
#7  0x00007fbf08d84536 in reopen_demux_for_component (s=s@entry=0x669e20, 
    pls=pls@entry=0x66e6e0) at libavformat/dashdec.c:1530
#8  0x00007fbf08d84dd5 in open_demux_for_component (s=s@entry=0x669e20, pls=0x66e6e0)
    at libavformat/dashdec.c:1565
#9  0x00007fbf08d8841d in dash_read_header (s=0x669e20) at libavformat/dashdec.c:1615
#10 0x00007fbf08eaf0ee in avformat_open_input (ps=ps@entry=0x7fffffffcb88, 
    filename=filename@entry=0x7fffffffde40 "http://download.tsi.telecom-paristech.fr/gpac/dataset/dash/uhd/dashevc-main-6s/dashevc-main-6s.mpd", fmt=fmt@entry=0x0, options=0x669c28)
    at libavformat/utils.c:595
#11 0x0000000000417b55 in open_input_file (o=o@entry=0x7fffffffcd40, 
    filename=<optimized out>) at ffmpeg_opt.c:1060
#12 0x0000000000419a23 in open_files (l=0x669bd8, l=0x669bd8, 
    open_file=0x4160d0 <open_input_file>, inout=0x43299f "input") at ffmpeg_opt.c:3278
#13 ffmpeg_parse_options (argc=argc@entry=3, argv=argv@entry=0x7fffffffda98)
    at ffmpeg_opt.c:3318
#14 0x0000000000408542 in main (argc=3, argv=0x7fffffffda98) at ffmpeg.c:4786

[colin ng]

The crash is caused by failing to handle the relative URL in the representation baseURL value.

[Steven Liu]

fix by commit: 7a63da891023767824af75ff1c9fe681c156ac19