From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 3C43E407EE for ; Thu, 29 Sep 2022 15:45:37 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 386C668BA3D; Thu, 29 Sep 2022 18:45:35 +0300 (EEST) Received: from relay5-d.mail.gandi.net (relay5-d.mail.gandi.net [217.70.183.197]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id EC23E68B021 for ; Thu, 29 Sep 2022 18:45:28 +0300 (EEST) Received: (Authenticated sender: michael@niedermayer.cc) by mail.gandi.net (Postfix) with ESMTPSA id E31B41C0007 for ; Thu, 29 Sep 2022 15:45:27 +0000 (UTC) Date: Thu, 29 Sep 2022 17:45:26 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20220929154526.GC6583@pb2> References: <20220922180852.20655-1-michael@niedermayer.cc> <166437816569.22057.983964854773409478@lain.khirnov.net> <20220928223509.GB6583@pb2> <166446062255.22057.14060430318465734011@lain.khirnov.net> MIME-Version: 1.0 In-Reply-To: <166446062255.22057.14060430318465734011@lain.khirnov.net> Subject: Re: [FFmpeg-devel] [PATCH 1/2] avformat/vividas: Check packet size X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============6644402259491661529==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============6644402259491661529== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="exKAuxcSaZxx4B14" Content-Disposition: inline --exKAuxcSaZxx4B14 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Sep 29, 2022 at 04:10:22PM +0200, Anton Khirnov wrote: > Quoting Michael Niedermayer (2022-09-29 00:35:09) > > On Wed, Sep 28, 2022 at 05:16:05PM +0200, Anton Khirnov wrote: > > > Quoting Michael Niedermayer (2022-09-22 20:08:51) > > > > Fixes: signed integer overflow: 119760682 - -2084600173 cannot be r= epresented in type 'int' > > > > Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzz= er-6745781167587328 > > > >=20 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-= fuzz/tree/master/projects/ffmpeg > > > > Signed-off-by: Michael Niedermayer > > > > --- > > > > libavformat/vividas.c | 13 +++++++++++-- > > > > 1 file changed, 11 insertions(+), 2 deletions(-) > > > >=20 > > > > diff --git a/libavformat/vividas.c b/libavformat/vividas.c > > > > index e9954f73ed0..e8efe49a5c0 100644 > > > > --- a/libavformat/vividas.c > > > > +++ b/libavformat/vividas.c > > > > @@ -683,6 +683,7 @@ static int viv_read_packet(AVFormatContext *s, > > > > =20 > > > > if (viv->sb_entries[viv->current_sb_entry].flag =3D=3D 0) { > > > > uint64_t v_size =3D ffio_read_varlen(pb); > > > > + int last, last_start; > > > > =20 > > > > if (!viv->num_audio) > > > > return AVERROR_INVALIDDATA; > > > > @@ -704,14 +705,22 @@ static int viv_read_packet(AVFormatContext *s, > > > > start =3D ffio_read_varlen(pb); > > > > pcm_bytes =3D ffio_read_varlen(pb); > > > > =20 > > > > - if (i > 0 && start =3D=3D 0) > > > > - break; > > > > + if (i > 0) { > > > > + if (start =3D=3D 0) > > > > + break; > > > > + if (start < last || start - (unsigned)last > INT_M= AX) > > >=20 > > > What is the second condition for? > >=20 > > start is signed int so are "copyies" of it > > "start < last" would allow a negative last with a large start > > the 2nd check handles that. > > the difference of consequtive values are stored as int later > >=20 > > The patch tried to leave the storage types and check for it. > > The types could be changed or some other checks could be used > > I was undecided on this patch a bit too. I picked this mainly > > to keep changes more minimal but maybe this was not the best > > choice >=20 > Checking that start >=3D 0 would fix this as well, wouldn't it? i agree > I don't > think it makes sense for it to be negative. well no, but i tried to minimize the chance of breaking something so the fix ended up looking a bit wonky ill change it to check for start >=3D 0 thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB The worst form of inequality is to try to make unequal things equal. -- Aristotle --exKAuxcSaZxx4B14 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEIAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCYzW9kgAKCRBhHseHBAsP q30CAJ9rq1q6/f17xn7Qv0WIe45GpeFVBwCgjEznodSrJqjq/SZ01SPwOEqdTtQ= =0EBg -----END PGP SIGNATURE----- --exKAuxcSaZxx4B14-- --===============6644402259491661529== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============6644402259491661529==--