[FFmpeg-devel] [PATCH 1/3] Revert "avformat/demux: Count EAGAIN as 100 bytes in relation to read limit in avformat_find_stream_info()"

[FFmpeg-devel] [PATCH 1/3] Revert "avformat/demux: Count EAGAIN as 100 bytes in relation to read limit in avformat_find_stream_info()"

[Marton Balint]

Modifying avformat_find_stream_info() behaviour based on the number of EAGAINs
it encounters is a hack which usually only hides the real issue if such thing
happen.

This reverts commit b0cac7082d8a3ff2d4f039af01b45c48bb578de7.
---
 libavformat/demux.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/libavformat/demux.c b/libavformat/demux.c
index e121253dfd..57720f4311 100644
--- a/libavformat/demux.c
+++ b/libavformat/demux.c
@@ -2615,10 +2615,8 @@ int avformat_find_stream_info(AVFormatContext *ic, AVDictionary **options)
         /* NOTE: A new stream can be added there if no header in file
          * (AVFMTCTX_NOHEADER). */
         ret = read_frame_internal(ic, pkt1);
-        if (ret == AVERROR(EAGAIN)) {
-            read_size += 100;
+        if (ret == AVERROR(EAGAIN))
             continue;
-        }
 
         if (ret < 0) {
             /* EOF or error*/
-- 
2.35.3

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/3] Revert "avformat/demux: Make read_frame_internal() return AVERREOR(EAGAIN) on stuck empty input parser"

[Marton Balint]

Hides the underlying real problem with a demuxer returning 0 sized packets.

This reverts commit 02699490c14e86105104940c009953081f69432c.
---
 libavformat/demux.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/libavformat/demux.c b/libavformat/demux.c
index 57720f4311..1620716716 100644
--- a/libavformat/demux.c
+++ b/libavformat/demux.c
@@ -1235,15 +1235,11 @@ static int read_frame_internal(AVFormatContext *s, AVPacket *pkt)
     FFFormatContext *const si = ffformatcontext(s);
     int ret, got_packet = 0;
     AVDictionary *metadata = NULL;
-    int empty = 0;
 
     while (!got_packet && !si->parse_queue.head) {
         AVStream *st;
         FFStream *sti;
 
-        if (empty > 1)
-            return AVERROR(EAGAIN);
-
         /* read next packet */
         ret = ff_read_packet(s, pkt);
         if (ret < 0) {
@@ -1334,8 +1330,6 @@ static int read_frame_internal(AVFormatContext *s, AVPacket *pkt)
             }
             got_packet = 1;
         } else if (st->discard < AVDISCARD_ALL) {
-            if (pkt->size == 0)
-                empty ++;
             if ((ret = parse_packet(s, pkt, pkt->stream_index, 0)) < 0)
                 return ret;
             st->codecpar->sample_rate = sti->avctx->sample_rate;
-- 
2.35.3

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/3] avformat/mov: disallow a zero sample size in trun atoms

[Marton Balint]

In order to not generate 0 sized packets or create a huge index table
needlessly.

Fixes: Timeout
Fixes: 43717/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5206008287330304
Fixes: 45738/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-6142535657979904

Signed-off-by: Marton Balint <cus@passwd.hu>
---
 libavformat/mov.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index c6fbe511c0..d7ef6ba6d6 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5179,6 +5179,8 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
         distance++;
         if (av_sat_add64(dts, sample_duration) != dts + (uint64_t)sample_duration)
             return AVERROR_INVALIDDATA;
+        if (!sample_size)
+            return AVERROR_INVALIDDATA;
         dts += sample_duration;
         offset += sample_size;
         sc->data_size += sample_size;
-- 
2.35.3

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/3] avformat/mov: disallow a zero sample size in trun atoms

["zhilizhao(赵志立)"]

> On Jun 28, 2022, at 4:02 AM, Marton Balint <cus@passwd.hu> wrote:
> 
> In order to not generate 0 sized packets or create a huge index table
> needlessly.
> 
> Fixes: Timeout
> Fixes: 43717/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5206008287330304
> Fixes: 45738/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-6142535657979904
> 
> Signed-off-by: Marton Balint <cus@passwd.hu>
> ---
> libavformat/mov.c | 2 ++
> 1 file changed, 2 insertions(+)
> 
> diff --git a/libavformat/mov.c b/libavformat/mov.c
> index c6fbe511c0..d7ef6ba6d6 100644
> --- a/libavformat/mov.c
> +++ b/libavformat/mov.c
> @@ -5179,6 +5179,8 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
>         distance++;
>         if (av_sat_add64(dts, sample_duration) != dts + (uint64_t)sample_duration)
>             return AVERROR_INVALIDDATA;
> +        if (!sample_size)
> +            return AVERROR_INVALIDDATA;
>         dts += sample_duration;
>         offset += sample_size;
>         sc->data_size += sample_size;

LGTM.

> -- 
> 2.35.3
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/3] Revert "avformat/demux: Count EAGAIN as 100 bytes in relation to read limit in avformat_find_stream_info()"

[Anton Khirnov]

Quoting Marton Balint (2022-06-27 22:02:39)
> Modifying avformat_find_stream_info() behaviour based on the number of EAGAINs
> it encounters is a hack which usually only hides the real issue if such thing
> happen.
> 
> This reverts commit b0cac7082d8a3ff2d4f039af01b45c48bb578de7.
> ---
>  libavformat/demux.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)

very much ok

-- 
Anton Khirnov
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/3] avformat/mov: disallow a zero sample size in trun atoms

[Marton Balint]

On Tue, 28 Jun 2022, "zhilizhao(赵志立)" wrote:

>
>
>> On Jun 28, 2022, at 4:02 AM, Marton Balint <cus@passwd.hu> wrote:
>>
>> In order to not generate 0 sized packets or create a huge index table
>> needlessly.
>>
>> Fixes: Timeout
>> Fixes: 43717/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5206008287330304
>> Fixes: 45738/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-6142535657979904
>>
>> Signed-off-by: Marton Balint <cus@passwd.hu>
>> ---
>> libavformat/mov.c | 2 ++
>> 1 file changed, 2 insertions(+)
>>
>> diff --git a/libavformat/mov.c b/libavformat/mov.c
>> index c6fbe511c0..d7ef6ba6d6 100644
>> --- a/libavformat/mov.c
>> +++ b/libavformat/mov.c
>> @@ -5179,6 +5179,8 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
>>         distance++;
>>         if (av_sat_add64(dts, sample_duration) != dts + (uint64_t)sample_duration)
>>             return AVERROR_INVALIDDATA;
>> +        if (!sample_size)
>> +            return AVERROR_INVALIDDATA;
>>         dts += sample_duration;
>>         offset += sample_size;
>>         sc->data_size += sample_size;
>
> LGTM.

Thanks, applied the series.

Regards,
Marton
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".