demux: add support for XSPF playlist files

[Gobbel2000]

This adds support for the playlist format XSPF (website). It is used by various music players, maybe most notably it is the default for exporting playlists in VLC.

As XSPF is an XML format, I used the libxml2 library in implementation. This would add a new dependency, although libxml2 is already a dependency of ffmpeg and probably present on most systems. I have added an appropriate entry to the wscript, mostly so that it compiles. I have no experience with WAF, so it is very probable that this part needs to be changed in order to comply with best practices.

Line 227 assumes that p->real_stream->path is always set. Is that the case? If not an alternative way would be to load the entire file into memory and then use xmlParseMemory() instead.

[bjin]

#if HAVE_LIBXML2

[Gobbel2000]

Good point. I've added a few #if's and it works as expected now with --disable-libxml2.

[Gobbel2000]

The short answer is no, I don't know whether libxml2 is the best option. This is the first time I've used an XML library for C and I basically looked for what is most commonly used and is easy enough to figure out, counting on the wisdom of the crowd. It does seem to control at least some parts in a global state, the way I suppressed the error outputs would be an example. I'll look a bit into what problems or security issues there might be. If you know a better alternative or I find something then I wouldn't be opposed to changing to a different library.

[jeeb]

I think around 5-10 or so years ago libxml2 had various issues due to trusting the input too much for its own good by default, but according to one of those people I know who looks up issues, apparently at this point it's not really that interesting as a target.

The main thing I would probably consider is whether one prefers the API of libxml2 or libexpat, and how much emphasis their documentation puts on using streaming parsing (as opposed to doing it in one big lump o' memory) as well as handling things securely.

Their CVE counts for recent years can be seen @
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=libxml2
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=expat

Expat has quite a bit less of CVEs in general, but one has to consider the proliferation of both libraries, and how much that affects things (more exposure means things get more poked, etc). Fortunately enough I have not yet had to dwell into this hornet's nest myself, so API wise I have not yet ventured into which seems like the less bad alternative.