[FFmpeg-devel] [PATCH] avcodec/g729_parser: Check channels

[FFmpeg-devel] [PATCH] avcodec/g729_parser: Check channels

[Michael Niedermayer]

Fixes: signed integer overflow: 10 * 808464428 cannot be represented in type 'int'
Fixes: assertion failure
Fixes: ticket9651

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/g729_parser.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/g729_parser.c b/libavcodec/g729_parser.c
index 8c06ce4ee6..4dcdeab651 100644
--- a/libavcodec/g729_parser.c
+++ b/libavcodec/g729_parser.c
@@ -48,6 +48,9 @@ static int g729_parse(AVCodecParserContext *s1, AVCodecContext *avctx,
         s->block_size = (avctx->bit_rate < 8000) ? G729D_6K4_BLOCK_SIZE : G729_8K_BLOCK_SIZE;
         if (avctx->codec_id == AV_CODEC_ID_ACELP_KELVIN)
             s->block_size++;
+        // channels > 2 is invalid, we pass the packet on unchanged
+        if (avctx->channels > 2)
+            s->block_size = 0;
         s->block_size *= avctx->channels;
         s->duration   = avctx->frame_size;
     }
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] avcodec/g729_parser: Check channels

[Paul B Mahol]

On Sun, Feb 27, 2022 at 2:51 PM Michael Niedermayer <michael@niedermayer.cc>
wrote:

> Fixes: signed integer overflow: 10 * 808464428 cannot be represented in
> type 'int'
> Fixes: assertion failure
> Fixes: ticket9651
>


LGTM

Is it possible for parser get 0 channels as input, so it could
theoretically loop forever?


>
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/g729_parser.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/libavcodec/g729_parser.c b/libavcodec/g729_parser.c
> index 8c06ce4ee6..4dcdeab651 100644
> --- a/libavcodec/g729_parser.c
> +++ b/libavcodec/g729_parser.c
> @@ -48,6 +48,9 @@ static int g729_parse(AVCodecParserContext *s1,
> AVCodecContext *avctx,
>          s->block_size = (avctx->bit_rate < 8000) ? G729D_6K4_BLOCK_SIZE :
> G729_8K_BLOCK_SIZE;
>          if (avctx->codec_id == AV_CODEC_ID_ACELP_KELVIN)
>              s->block_size++;
> +        // channels > 2 is invalid, we pass the packet on unchanged
> +        if (avctx->channels > 2)
> +            s->block_size = 0;
>          s->block_size *= avctx->channels;
>          s->duration   = avctx->frame_size;
>      }
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] avcodec/g729_parser: Check channels

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 672 bytes --]

On Sun, Feb 27, 2022 at 03:02:46PM +0100, Paul B Mahol wrote:
> On Sun, Feb 27, 2022 at 2:51 PM Michael Niedermayer <michael@niedermayer.cc>
> wrote:
> 
> > Fixes: signed integer overflow: 10 * 808464428 cannot be represented in
> > type 'int'
> > Fixes: assertion failure
> > Fixes: ticket9651
> >
> 
> 
> LGTM

will apply


> 
> Is it possible for parser get 0 channels as input, so it could
> theoretically loop forever?

there is a check for block_size == 0 a few lines later

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Democracy is the form of government in which you can choose your dictator

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".