From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <ffmpeg-devel-bounces@ffmpeg.org>
Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100])
by master.gitmailbox.com (Postfix) with ESMTP id 863D042ADB
for <ffmpegdev@gitmailbox.com>; Tue, 11 Jan 2022 20:47:47 +0000 (UTC)
Received: from [127.0.1.1] (localhost [127.0.0.1])
by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 09FBC68AE71;
Tue, 11 Jan 2022 22:47:34 +0200 (EET)
Received: from mail0.khirnov.net (unknown [176.97.15.12])
by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id BCA0268A6E0
for <ffmpeg-devel@ffmpeg.org>; Tue, 11 Jan 2022 22:47:26 +0200 (EET)
Received: from localhost (localhost [IPv6:::1])
by mail0.khirnov.net (Postfix) with ESMTP id 9D5CA24056A
for <ffmpeg-devel@ffmpeg.org>; Tue, 11 Jan 2022 21:47:25 +0100 (CET)
Received: from mail0.khirnov.net ([IPv6:::1])
by localhost (mail0.khirnov.net [IPv6:::1]) (amavisd-new, port 10024)
with ESMTP id 1SPfFdU9-pmD for <ffmpeg-devel@ffmpeg.org>;
Tue, 11 Jan 2022 21:47:25 +0100 (CET)
Received: from libav.khirnov.net (libav.khirnov.net
[IPv6:2a00:c500:561:201::7])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
client-signature RSA-PSS (2048 bits) client-digest SHA256)
(Client CN "libav.khirnov.net",
Issuer "smtp.khirnov.net SMTP CA" (verified OK))
by mail0.khirnov.net (Postfix) with ESMTPS id 181EA240179
for <ffmpeg-devel@ffmpeg.org>; Tue, 11 Jan 2022 21:47:25 +0100 (CET)
Received: by libav.khirnov.net (Postfix, from userid 1000)
id E15683A0631; Tue, 11 Jan 2022 21:47:24 +0100 (CET)
From: Anton Khirnov <anton@khirnov.net>
To: ffmpeg-devel@ffmpeg.org
Date: Tue, 11 Jan 2022 21:45:36 +0100
Message-Id: <20220111204610.14262-1-anton@khirnov.net>
X-Mailer: git-send-email 2.33.0
MIME-Version: 1.0
Subject: [FFmpeg-devel] [PATCH 01/35] lavu/fifo: disallow overly large fifo
sizes
X-BeenThere: ffmpeg-devel@ffmpeg.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: FFmpeg development discussions and patches <ffmpeg-devel.ffmpeg.org>
List-Unsubscribe: <https://ffmpeg.org/mailman/options/ffmpeg-devel>,
<mailto:ffmpeg-devel-request@ffmpeg.org?subject=unsubscribe>
List-Archive: <https://ffmpeg.org/pipermail/ffmpeg-devel>
List-Post: <mailto:ffmpeg-devel@ffmpeg.org>
List-Help: <mailto:ffmpeg-devel-request@ffmpeg.org?subject=help>
List-Subscribe: <https://ffmpeg.org/mailman/listinfo/ffmpeg-devel>,
<mailto:ffmpeg-devel-request@ffmpeg.org?subject=subscribe>
Reply-To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: ffmpeg-devel-bounces@ffmpeg.org
Sender: "ffmpeg-devel" <ffmpeg-devel-bounces@ffmpeg.org>
Archived-At: <https://master.gitmailbox.com/ffmpegdev/20220111204610.14262-1-anton@khirnov.net/>
List-Archive: <https://master.gitmailbox.com/ffmpegdev/>
List-Post: <mailto:ffmpegdev@gitmailbox.com>
The API currently allows creating FIFOs up to
- UINT_MAX: av_fifo_alloc(), av_fifo_realloc(), av_fifo_grow()
- SIZE_MAX: av_fifo_alloc_array()
However the usable limit is determined by
- rndx/wndx being uint32_t
- av_fifo_[size,space] returning int
so no FIFO should be larger than the smallest of
- INT_MAX
- UINT32_MAX
- SIZE_MAX
(which should be INT_MAX an all commonly used platforms).
Return an error on trying to allocate FIFOs larger than this limit.
---
libavutil/fifo.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/libavutil/fifo.c b/libavutil/fifo.c
index d741bdd395..f2f046b1f3 100644
--- a/libavutil/fifo.c
+++ b/libavutil/fifo.c
@@ -20,14 +20,23 @@
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
+#include <stdint.h>
+
#include "avassert.h"
#include "common.h"
#include "fifo.h"
+#define FIFO_SIZE_MAX FFMIN3((uint64_t)INT_MAX, (uint64_t)UINT32_MAX, (uint64_t)SIZE_MAX)
+
AVFifoBuffer *av_fifo_alloc_array(size_t nmemb, size_t size)
{
AVFifoBuffer *f;
- void *buffer = av_realloc_array(NULL, nmemb, size);
+ void *buffer;
+
+ if (nmemb > FIFO_SIZE_MAX / size)
+ return NULL;
+
+ buffer = av_realloc_array(NULL, nmemb, size);
if (!buffer)
return NULL;
f = av_mallocz(sizeof(AVFifoBuffer));
@@ -82,6 +91,9 @@ int av_fifo_realloc2(AVFifoBuffer *f, unsigned int new_size)
{
unsigned int old_size = f->end - f->buffer;
+ if (new_size > FIFO_SIZE_MAX)
+ return AVERROR(EINVAL);
+
if (old_size < new_size) {
size_t offset_r = f->rptr - f->buffer;
size_t offset_w = f->wptr - f->buffer;
--
2.33.0
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".