Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
 help / color / mirror / Atom feed
* [FFmpeg-devel] [PATCH 01/35] lavu/fifo: disallow overly large fifo sizes
@ 2022-01-11 20:45 Anton Khirnov
  2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 02/35] lavu/fifo: make the contents of AVFifoBuffer private on next major bump Anton Khirnov
                   ` (35 more replies)
  0 siblings, 36 replies; 53+ messages in thread
From: Anton Khirnov @ 2022-01-11 20:45 UTC (permalink / raw)
  To: ffmpeg-devel

The API currently allows creating FIFOs up to
- UINT_MAX: av_fifo_alloc(), av_fifo_realloc(), av_fifo_grow()
- SIZE_MAX: av_fifo_alloc_array()
However the usable limit is determined by
- rndx/wndx being uint32_t
- av_fifo_[size,space] returning int
so no FIFO should be larger than the smallest of
- INT_MAX
- UINT32_MAX
- SIZE_MAX
(which should be INT_MAX an all commonly used platforms).
Return an error on trying to allocate FIFOs larger than this limit.
---
 libavutil/fifo.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/libavutil/fifo.c b/libavutil/fifo.c
index d741bdd395..f2f046b1f3 100644
--- a/libavutil/fifo.c
+++ b/libavutil/fifo.c
@@ -20,14 +20,23 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
+#include <stdint.h>
+
 #include "avassert.h"
 #include "common.h"
 #include "fifo.h"
 
+#define FIFO_SIZE_MAX FFMIN3((uint64_t)INT_MAX, (uint64_t)UINT32_MAX, (uint64_t)SIZE_MAX)
+
 AVFifoBuffer *av_fifo_alloc_array(size_t nmemb, size_t size)
 {
     AVFifoBuffer *f;
-    void *buffer = av_realloc_array(NULL, nmemb, size);
+    void *buffer;
+
+    if (nmemb > FIFO_SIZE_MAX / size)
+        return NULL;
+
+    buffer = av_realloc_array(NULL, nmemb, size);
     if (!buffer)
         return NULL;
     f = av_mallocz(sizeof(AVFifoBuffer));
@@ -82,6 +91,9 @@ int av_fifo_realloc2(AVFifoBuffer *f, unsigned int new_size)
 {
     unsigned int old_size = f->end - f->buffer;
 
+    if (new_size > FIFO_SIZE_MAX)
+        return AVERROR(EINVAL);
+
     if (old_size < new_size) {
         size_t offset_r = f->rptr - f->buffer;
         size_t offset_w = f->wptr - f->buffer;
-- 
2.33.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 53+ messages in thread

end of thread, other threads:[~2022-01-13 19:03 UTC | newest]

Thread overview: 53+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-11 20:45 [FFmpeg-devel] [PATCH 01/35] lavu/fifo: disallow overly large fifo sizes Anton Khirnov
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 02/35] lavu/fifo: make the contents of AVFifoBuffer private on next major bump Anton Khirnov
2022-01-13 14:22   ` Andreas Rheinhardt
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 03/35] lavu/fifo: introduce the notion of element size Anton Khirnov
2022-01-13 16:50   ` Andreas Rheinhardt
2022-01-13 16:59   ` James Almer
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 04/35] lavu/fifo: add new functions for determinining reading/writing size Anton Khirnov
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 05/35] lavu/fifo: add a new FIFO grow function Anton Khirnov
2022-01-13 17:04   ` James Almer
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 06/35] lavu/fifo: add a new function for draining the FIFO Anton Khirnov
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 07/35] lavu/fifo: add new FIFO writing functions Anton Khirnov
2022-01-13 17:31   ` Andreas Rheinhardt
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 08/35] lavu/fifo: add new FIFO read/peek functions Anton Khirnov
2022-01-13 17:41   ` Andreas Rheinhardt
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 09/35] lavu/fifo: add a flag for automatically growing the FIFO as needed Anton Khirnov
2022-01-13 17:53   ` Andreas Rheinhardt
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 10/35] lavu/fifo: deprecate old API Anton Khirnov
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 11/35] lavu/tests/fifo: switch to the new API Anton Khirnov
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 12/35] lavc/avcodec: switch to new FIFO API Anton Khirnov
2022-01-13 18:21   ` Andreas Rheinhardt
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 13/35] lavc/amfenc: " Anton Khirnov
2022-01-12 14:46   ` Michael Niedermayer
2022-01-12 19:29     ` Anton Khirnov
2022-01-13 14:14       ` Michael Niedermayer
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 14/35] lavc/cuviddec: do not reallocate the fifo unnecessarily Anton Khirnov
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 15/35] lavc/cuviddec: convert to the new FIFO API Anton Khirnov
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 16/35] lavc/libvorbisenc: switch to " Anton Khirnov
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 17/35] lavc/libvpxenc: switch to the " Anton Khirnov
2022-01-12 18:15   ` James Zern
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 18/35] lavc/libvpxenc: remove unneeded context variable Anton Khirnov
2022-01-12 18:15   ` James Zern
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 19/35] lavc/nvenc: switch to the new FIFO API Anton Khirnov
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 20/35] lavc/qsvdec: " Anton Khirnov
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 21/35] lavc/qsvenc: switch to " Anton Khirnov
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 22/35] lavf/dvenc: return an error on audio/video desync Anton Khirnov
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 23/35] lavf/dvenc: switch to new FIFO API Anton Khirnov
2022-01-11 20:45 ` [FFmpeg-devel] [PATCH 24/35] lavf/mpegenc: " Anton Khirnov
2022-01-11 20:46 ` [FFmpeg-devel] [PATCH 25/35] lavf/swfenc: " Anton Khirnov
2022-01-11 20:46 ` [FFmpeg-devel] [PATCH 26/35] lavf/udp: " Anton Khirnov
2022-01-13 18:45   ` Andreas Rheinhardt
2022-01-11 20:46 ` [FFmpeg-devel] [PATCH 27/35] lavf/async: " Anton Khirnov
2022-01-11 20:46 ` [FFmpeg-devel] [PATCH 28/35] lavd/jack: switch to the " Anton Khirnov
2022-01-11 20:46 ` [FFmpeg-devel] [PATCH 29/35] lavu/audio_fifo: drop an unnecessary include Anton Khirnov
2022-01-11 20:46 ` [FFmpeg-devel] [PATCH 30/35] lavu/audio_fifo: switch to new FIFO API Anton Khirnov
2022-01-11 20:46 ` [FFmpeg-devel] [PATCH 31/35] lavu/threadmessage: " Anton Khirnov
2022-01-13 19:03   ` Andreas Rheinhardt
2022-01-11 20:46 ` [FFmpeg-devel] [PATCH 32/35] lavfi/qsvvpp: " Anton Khirnov
2022-01-11 20:46 ` [FFmpeg-devel] [PATCH 33/35] lavfi/vf_deshake_opencl: " Anton Khirnov
2022-01-11 20:46 ` [FFmpeg-devel] [PATCH 34/35] ffplay: " Anton Khirnov
2022-01-11 20:46 ` [FFmpeg-devel] [PATCH 35/35] ffmpeg: " Anton Khirnov
2022-01-13 13:59 ` [FFmpeg-devel] [PATCH 01/35] lavu/fifo: disallow overly large fifo sizes Andreas Rheinhardt
2022-01-13 14:27 ` Anton Khirnov
2022-01-13 14:38   ` Andreas Rheinhardt

Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
		ffmpegdev@gitmailbox.com
	public-inbox-index ffmpegdev

Example config snippet for mirrors.


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git