From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id D9EBA422B5 for ; Wed, 28 Sep 2022 22:35:21 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 2853F68BC4F; Thu, 29 Sep 2022 01:35:18 +0300 (EEST) Received: from relay7-d.mail.gandi.net (relay7-d.mail.gandi.net [217.70.183.200]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 4382E68BAE2 for ; Thu, 29 Sep 2022 01:35:12 +0300 (EEST) Received: (Authenticated sender: michael@niedermayer.cc) by mail.gandi.net (Postfix) with ESMTPSA id 6737C20004 for ; Wed, 28 Sep 2022 22:35:11 +0000 (UTC) Date: Thu, 29 Sep 2022 00:35:09 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20220928223509.GB6583@pb2> References: <20220922180852.20655-1-michael@niedermayer.cc> <166437816569.22057.983964854773409478@lain.khirnov.net> MIME-Version: 1.0 In-Reply-To: <166437816569.22057.983964854773409478@lain.khirnov.net> Subject: Re: [FFmpeg-devel] [PATCH 1/2] avformat/vividas: Check packet size X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============9111212896447055631==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============9111212896447055631== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="PAKmkkBo0+rTwAqJ" Content-Disposition: inline --PAKmkkBo0+rTwAqJ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Sep 28, 2022 at 05:16:05PM +0200, Anton Khirnov wrote: > Quoting Michael Niedermayer (2022-09-22 20:08:51) > > Fixes: signed integer overflow: 119760682 - -2084600173 cannot be repre= sented in type 'int' > > Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6= 745781167587328 > >=20 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz= /tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer > > --- > > libavformat/vividas.c | 13 +++++++++++-- > > 1 file changed, 11 insertions(+), 2 deletions(-) > >=20 > > diff --git a/libavformat/vividas.c b/libavformat/vividas.c > > index e9954f73ed0..e8efe49a5c0 100644 > > --- a/libavformat/vividas.c > > +++ b/libavformat/vividas.c > > @@ -683,6 +683,7 @@ static int viv_read_packet(AVFormatContext *s, > > =20 > > if (viv->sb_entries[viv->current_sb_entry].flag =3D=3D 0) { > > uint64_t v_size =3D ffio_read_varlen(pb); > > + int last, last_start; > > =20 > > if (!viv->num_audio) > > return AVERROR_INVALIDDATA; > > @@ -704,14 +705,22 @@ static int viv_read_packet(AVFormatContext *s, > > start =3D ffio_read_varlen(pb); > > pcm_bytes =3D ffio_read_varlen(pb); > > =20 > > - if (i > 0 && start =3D=3D 0) > > - break; > > + if (i > 0) { > > + if (start =3D=3D 0) > > + break; > > + if (start < last || start - (unsigned)last > INT_MAX) >=20 > What is the second condition for? start is signed int so are "copyies" of it "start < last" would allow a negative last with a large start the 2nd check handles that. the difference of consequtive values are stored as int later The patch tried to leave the storage types and check for it. The types could be changed or some other checks could be used I was undecided on this patch a bit too. I picked this mainly to keep changes more minimal but maybe this was not the best choice Thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB No great genius has ever existed without some touch of madness. -- Aristotle --PAKmkkBo0+rTwAqJ Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEIAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCYzTMFAAKCRBhHseHBAsP q/Y2AJ9YJoTJsGWTi4dKM/u1Iq9XOz+wJACgl2vFKHl7HNBUUgkDQtxilcJL5a0= =jsNl -----END PGP SIGNATURE----- --PAKmkkBo0+rTwAqJ-- --===============9111212896447055631== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============9111212896447055631==--