From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 863D042ADB for ; Tue, 11 Jan 2022 20:47:47 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 09FBC68AE71; Tue, 11 Jan 2022 22:47:34 +0200 (EET) Received: from mail0.khirnov.net (unknown [176.97.15.12]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id BCA0268A6E0 for ; Tue, 11 Jan 2022 22:47:26 +0200 (EET) Received: from localhost (localhost [IPv6:::1]) by mail0.khirnov.net (Postfix) with ESMTP id 9D5CA24056A for ; Tue, 11 Jan 2022 21:47:25 +0100 (CET) Received: from mail0.khirnov.net ([IPv6:::1]) by localhost (mail0.khirnov.net [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id 1SPfFdU9-pmD for ; Tue, 11 Jan 2022 21:47:25 +0100 (CET) Received: from libav.khirnov.net (libav.khirnov.net [IPv6:2a00:c500:561:201::7]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "libav.khirnov.net", Issuer "smtp.khirnov.net SMTP CA" (verified OK)) by mail0.khirnov.net (Postfix) with ESMTPS id 181EA240179 for ; Tue, 11 Jan 2022 21:47:25 +0100 (CET) Received: by libav.khirnov.net (Postfix, from userid 1000) id E15683A0631; Tue, 11 Jan 2022 21:47:24 +0100 (CET) From: Anton Khirnov To: ffmpeg-devel@ffmpeg.org Date: Tue, 11 Jan 2022 21:45:36 +0100 Message-Id: <20220111204610.14262-1-anton@khirnov.net> X-Mailer: git-send-email 2.33.0 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH 01/35] lavu/fifo: disallow overly large fifo sizes X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: The API currently allows creating FIFOs up to - UINT_MAX: av_fifo_alloc(), av_fifo_realloc(), av_fifo_grow() - SIZE_MAX: av_fifo_alloc_array() However the usable limit is determined by - rndx/wndx being uint32_t - av_fifo_[size,space] returning int so no FIFO should be larger than the smallest of - INT_MAX - UINT32_MAX - SIZE_MAX (which should be INT_MAX an all commonly used platforms). Return an error on trying to allocate FIFOs larger than this limit. --- libavutil/fifo.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/libavutil/fifo.c b/libavutil/fifo.c index d741bdd395..f2f046b1f3 100644 --- a/libavutil/fifo.c +++ b/libavutil/fifo.c @@ -20,14 +20,23 @@ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ +#include + #include "avassert.h" #include "common.h" #include "fifo.h" +#define FIFO_SIZE_MAX FFMIN3((uint64_t)INT_MAX, (uint64_t)UINT32_MAX, (uint64_t)SIZE_MAX) + AVFifoBuffer *av_fifo_alloc_array(size_t nmemb, size_t size) { AVFifoBuffer *f; - void *buffer = av_realloc_array(NULL, nmemb, size); + void *buffer; + + if (nmemb > FIFO_SIZE_MAX / size) + return NULL; + + buffer = av_realloc_array(NULL, nmemb, size); if (!buffer) return NULL; f = av_mallocz(sizeof(AVFifoBuffer)); @@ -82,6 +91,9 @@ int av_fifo_realloc2(AVFifoBuffer *f, unsigned int new_size) { unsigned int old_size = f->end - f->buffer; + if (new_size > FIFO_SIZE_MAX) + return AVERROR(EINVAL); + if (old_size < new_size) { size_t offset_r = f->rptr - f->buffer; size_t offset_w = f->wptr - f->buffer; -- 2.33.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".