* [FFmpeg-devel] [PATCH 0/1] avcodec/exr: variable string attribute length
@ 2022-05-12 15:30 vectronic
2022-05-12 15:30 ` [FFmpeg-devel] [PATCH 1/1] fix: use declared size for attribute of type string to ensure full value used and prevent parse failure for string lengths longer than 256 vectronic
0 siblings, 1 reply; 3+ messages in thread
From: vectronic @ 2022-05-12 15:30 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: vectronic
fix: use declared size for attribute of type string to ensure full
value used and prevent parse failure for string lengths longer than
256
libavcodec/exr.c | 32 +++++++++++++++++++++++---------
1 file changed, 23 insertions(+), 9 deletions(-)
--
2.32.0 (Apple Git-132)
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 3+ messages in thread* [FFmpeg-devel] [PATCH 1/1] fix: use declared size for attribute of type string to ensure full value used and prevent parse failure for string lengths longer than 256 2022-05-12 15:30 [FFmpeg-devel] [PATCH 0/1] avcodec/exr: variable string attribute length vectronic @ 2022-05-12 15:30 ` vectronic 2022-05-14 10:41 ` Paul B Mahol 0 siblings, 1 reply; 3+ messages in thread From: vectronic @ 2022-05-12 15:30 UTC (permalink / raw) To: ffmpeg-devel; +Cc: vectronic Signed-off-by: vectronic <hello.vectronic@gmail.com> --- libavcodec/exr.c | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/libavcodec/exr.c b/libavcodec/exr.c index 8cd867a32f..bc2afcee53 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -1912,10 +1912,13 @@ static int decode_header(EXRContext *s, AVFrame *frame) continue; } else if ((var_size = check_header_variable(s, "writer", "string", 1)) >= 0) { - uint8_t key[256] = { 0 }; + uint8_t *key = av_malloc(var_size); - bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1, var_size)); - av_dict_set(&metadata, "writer", key, 0); + if (!key) + return AVERROR(ENOMEM); + + bytestream2_get_buffer(gb, key, var_size); + av_dict_set(&metadata, "writer", key, AV_DICT_DONT_STRDUP_VAL); continue; } else if ((var_size = check_header_variable(s, "framesPerSecond", @@ -1937,9 +1940,12 @@ static int decode_header(EXRContext *s, AVFrame *frame) continue; } else if ((var_size = check_header_variable(s, "type", "string", 16)) >= 0) { - uint8_t key[256] = { 0 }; + uint8_t *key = av_malloc(var_size); + + if (!key) + return AVERROR(ENOMEM); - bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1, var_size)); + bytestream2_get_buffer(gb, key, var_size); if (strncmp("scanlineimage", key, var_size) && strncmp("tiledimage", key, var_size)) return AVERROR_PATCHWELCOME; @@ -1970,7 +1976,6 @@ static int decode_header(EXRContext *s, AVFrame *frame) { uint8_t name[256] = { 0 }; uint8_t type[256] = { 0 }; - uint8_t value[256] = { 0 }; int i = 0, size; while (bytestream2_get_bytes_left(gb) > 0 && @@ -1987,9 +1992,18 @@ static int decode_header(EXRContext *s, AVFrame *frame) bytestream2_skip(gb, 1); size = bytestream2_get_le32(gb); - bytestream2_get_buffer(gb, value, FFMIN(sizeof(value) - 1, size)); - if (!strcmp(type, "string")) - av_dict_set(&metadata, name, value, 0); + if (strcmp(type, "string") != 0) { + bytestream2_skip(gb, size); + + continue; + } + uint8_t *value = av_malloc(size); + + if (!value) + return AVERROR(ENOMEM); + + bytestream2_get_buffer(gb, value, size); + av_dict_set(&metadata, name, value, AV_DICT_DONT_STRDUP_VAL); } } -- 2.32.0 (Apple Git-132) _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [FFmpeg-devel] [PATCH 1/1] fix: use declared size for attribute of type string to ensure full value used and prevent parse failure for string lengths longer than 256 2022-05-12 15:30 ` [FFmpeg-devel] [PATCH 1/1] fix: use declared size for attribute of type string to ensure full value used and prevent parse failure for string lengths longer than 256 vectronic @ 2022-05-14 10:41 ` Paul B Mahol 0 siblings, 0 replies; 3+ messages in thread From: Paul B Mahol @ 2022-05-14 10:41 UTC (permalink / raw) To: FFmpeg development discussions and patches; +Cc: vectronic On Thu, May 12, 2022 at 5:31 PM vectronic <hello.vectronic@gmail.com> wrote: > Signed-off-by: vectronic <hello.vectronic@gmail.com> > --- > libavcodec/exr.c | 32 +++++++++++++++++++++++--------- > 1 file changed, 23 insertions(+), 9 deletions(-) > > diff --git a/libavcodec/exr.c b/libavcodec/exr.c > index 8cd867a32f..bc2afcee53 100644 > --- a/libavcodec/exr.c > +++ b/libavcodec/exr.c > @@ -1912,10 +1912,13 @@ static int decode_header(EXRContext *s, AVFrame > *frame) > continue; > } else if ((var_size = check_header_variable(s, "writer", > "string", 1)) >= 0) { > - uint8_t key[256] = { 0 }; > + uint8_t *key = av_malloc(var_size); > > - bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1, > var_size)); > - av_dict_set(&metadata, "writer", key, 0); > + if (!key) > + return AVERROR(ENOMEM); > + > + bytestream2_get_buffer(gb, key, var_size); > + av_dict_set(&metadata, "writer", key, > AV_DICT_DONT_STRDUP_VAL); > var_size can be very big number, potentially causing attacks vectors. > > continue; > } else if ((var_size = check_header_variable(s, "framesPerSecond", > @@ -1937,9 +1940,12 @@ static int decode_header(EXRContext *s, AVFrame > *frame) > continue; > } else if ((var_size = check_header_variable(s, "type", > "string", 16)) >= 0) > { > - uint8_t key[256] = { 0 }; > + uint8_t *key = av_malloc(var_size); > + > + if (!key) > + return AVERROR(ENOMEM); > > - bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1, > var_size)); > + bytestream2_get_buffer(gb, key, var_size); > if (strncmp("scanlineimage", key, var_size) && > strncmp("tiledimage", key, var_size)) > return AVERROR_PATCHWELCOME; > @@ -1970,7 +1976,6 @@ static int decode_header(EXRContext *s, AVFrame > *frame) > { > uint8_t name[256] = { 0 }; > uint8_t type[256] = { 0 }; > - uint8_t value[256] = { 0 }; > int i = 0, size; > > while (bytestream2_get_bytes_left(gb) > 0 && > @@ -1987,9 +1992,18 @@ static int decode_header(EXRContext *s, AVFrame > *frame) > bytestream2_skip(gb, 1); > size = bytestream2_get_le32(gb); > > - bytestream2_get_buffer(gb, value, FFMIN(sizeof(value) - 1, > size)); > - if (!strcmp(type, "string")) > - av_dict_set(&metadata, name, value, 0); > + if (strcmp(type, "string") != 0) { > + bytestream2_skip(gb, size); > + > + continue; > + } > + uint8_t *value = av_malloc(size); > + > + if (!value) > + return AVERROR(ENOMEM); > + > + bytestream2_get_buffer(gb, value, size); > + av_dict_set(&metadata, name, value, AV_DICT_DONT_STRDUP_VAL); > } > } > > -- > 2.32.0 (Apple Git-132) > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". > _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-05-14 10:38 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2022-05-12 15:30 [FFmpeg-devel] [PATCH 0/1] avcodec/exr: variable string attribute length vectronic 2022-05-12 15:30 ` [FFmpeg-devel] [PATCH 1/1] fix: use declared size for attribute of type string to ensure full value used and prevent parse failure for string lengths longer than 256 vectronic 2022-05-14 10:41 ` Paul B Mahol
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel This inbox may be cloned and mirrored by anyone: git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \ ffmpegdev@gitmailbox.com public-inbox-index ffmpegdev Example config snippet for mirrors. AGPL code for this site: git clone https://public-inbox.org/public-inbox.git