From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) by master.gitmailbox.com (Postfix) with ESMTPS id A6C7C406D5 for ; Wed, 22 Dec 2021 15:13:52 +0000 (UTC) Received: by mail-pl1-f176.google.com with SMTP id x15so2119614plg.1 for ; Wed, 22 Dec 2021 07:13:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=lc/VWTpolDZBfz5R/QmXML2426DZ4/F031HcZeu/jBM=; b=mhotIsiJ9YbxhneKJiZHR5TnB2MzaODkTULK/7UIUuQFw4QXMaSu1Pf0BZuJpRIPbd BDUl3nvHUchmZdkjHz+xCrAGQkNQ7scaJQNdFYQbSc6917vTG6yDkEQiqnchFPXBbgHD t4fw5sx5+H7fkJdyd29wK8JVW0Q7P9m41XdoI6inrXU2LRxO5IZgyoEaEcj/fknJ3kuI LPAcWyfqh5o2VCWY7EiH9K4gBqqYGWpo3u1KGjaGT1nY6ndVbu9bG3BwgTG1ztYMW1+w I2/2YPrVTnhCapycbiMfWYSvGxnMiqwQv1hdn8VtV21+vmfun+lDYRgd5OBn5FlPAdJJ nzyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=lc/VWTpolDZBfz5R/QmXML2426DZ4/F031HcZeu/jBM=; b=KeamjHZH1GvQYutI6EY9m0OUd2LbpcMxNwcmW7kO5wV/zRw8Yz45WShVG3EhBcpFG+ AMp7VEMJUb9+Gk/CkrFpZZBhBVBkUTZ8u5KCPOiU1jrtNlxR7nP5v85oBeFlx1kvswBW emdbV9kpJwUocn1poVsCdqn1DPZ6+UMpqNUR8F8ASzIB8nUoiPspoIpuCh8L3TRTRsxR uG+ruVfRkAsvOHaWA4cWJCoOHSs76p4PnrwL1kc+1X0+t1Xc2cqwXXdgLFbruy0XrhRV ll61vGxdubVY6RzrW4r5Z4Biu/k3sNbwkGUe78m9DLmevxiL+SUawzHdVRolH6hbOzMH eJaA== X-Gm-Message-State: AOAM532nKtdClDcvlHSGg+vNWxK1enUipdSLt7G+jApFfGV2vYPHvJOU jFbBs2f6ozYYJtdKF6zhZ2NDlBrR8/Jv5Gk0 X-Google-Smtp-Source: ABdhPJz8OFDN4pByN+NRCFBV3x6Tk8et/n/miIhiJSQffXCIvEJhTcxWBJXoEYWFTNECEiUCjDQlHA== X-Received: by 2002:a17:902:7291:b0:148:af12:91ac with SMTP id d17-20020a170902729100b00148af1291acmr3300843pll.134.1640186032371; Wed, 22 Dec 2021 07:13:52 -0800 (PST) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id j7sm2941244pfu.164.2021.12.22.07.13.51 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Dec 2021 07:13:52 -0800 (PST) Message-Id: <1e8c0fa0589539f6c5480fc866b3c63e0154ed10.1640186030.git.ffmpegagent@gmail.com> In-Reply-To: References: From: ffmpegagent Date: Wed, 22 Dec 2021 15:13:40 +0000 Subject: [PATCH 01/11] libavformat/asf: fix handling of byte array length values Fcc: Sent Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit MIME-Version: 1.0 To: ffmpegdev@gitmailbox.com Cc: softworkz , softworkz Archived-At: List-Archive: List-Post: From: softworkz The spec allows attachment sizes of up to UINT32_MAX while we can handle only sizes up to INT32_MAX (in downstream code) The debug.assert in get_tag didn't really address this, and truncating the value_len in calling methods cannot be used because the length value is required in order to continue parsing. This adds a check with log message in ff_asf_handle_byte_array to handle those (rare) cases. Signed-off-by: softworkz --- libavformat/asf.c | 12 +++++++++--- libavformat/asf.h | 2 +- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/libavformat/asf.c b/libavformat/asf.c index 1ac8b5f078..179b66a2b4 100644 --- a/libavformat/asf.c +++ b/libavformat/asf.c @@ -267,12 +267,18 @@ static int get_id3_tag(AVFormatContext *s, int len) } int ff_asf_handle_byte_array(AVFormatContext *s, const char *name, - int val_len) + uint32_t val_len) { + if (val_len > INT32_MAX) { + av_log(s, AV_LOG_VERBOSE, "Unable to handle byte arrays > INT32_MAX in tag %s.\n", name); + return 1; + } + if (!strcmp(name, "WM/Picture")) // handle cover art - return asf_read_picture(s, val_len); + return asf_read_picture(s, (int)val_len); else if (!strcmp(name, "ID3")) // handle ID3 tag - return get_id3_tag(s, val_len); + return get_id3_tag(s, (int)val_len); + av_log(s, AV_LOG_VERBOSE, "Unsupported byte array in tag %s.\n", name); return 1; } diff --git a/libavformat/asf.h b/libavformat/asf.h index 01cc4f7a46..4d28560f56 100644 --- a/libavformat/asf.h +++ b/libavformat/asf.h @@ -111,7 +111,7 @@ extern const AVMetadataConv ff_asf_metadata_conv[]; * is unsupported by this function and 0 otherwise. */ int ff_asf_handle_byte_array(AVFormatContext *s, const char *name, - int val_len); + uint32_t val_len); #define ASF_PACKET_FLAG_ERROR_CORRECTION_PRESENT 0x80 //1000 0000 -- gitgitgadget