From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id D0EF844189 for ; Fri, 30 Sep 2022 14:19:57 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 1429E68BBAF; Fri, 30 Sep 2022 17:19:55 +0300 (EEST) Received: from mail-wr1-f49.google.com (mail-wr1-f49.google.com [209.85.221.49]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 2CD3068B903 for ; Fri, 30 Sep 2022 17:19:49 +0300 (EEST) Received: by mail-wr1-f49.google.com with SMTP id s14so7127630wro.0 for ; Fri, 30 Sep 2022 07:19:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date; bh=f0DWgi1NSD0tlcnInnZoQe/A2/7zhdJgs2fTj2EMY9Y=; b=UmekP24xmj7U27fQlYC5d1VG0M84RYrkpcaKTN4CGR4EtzqB0XWMIhJBNav/uOJKKZ eWjGSl6RG0AM2ZL/M8xVGa4eTy3TtPn4nbOdFnGAhjZpRVRRww7qx/Sp8Urhy1/ZO00i v09g+Vo8MydNsOchrBbHH2ALZ+i9en1sYO6XMpPNSGN0tTWLXnKkfrP2ZZ6/GiEzwe04 VzhEYnGJbVHHg6A90On80CwlKnURj5GYkoFs6tk6nVvOVFrBRL3cXeJjA12W4oVd8+EV CQIB9mFoFYGhRdCv0aQolR5p4Z+aejI5rVJbwahiDdxshm0t10SdzfFs1+WscgFYxTR2 nw1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date; bh=f0DWgi1NSD0tlcnInnZoQe/A2/7zhdJgs2fTj2EMY9Y=; b=MBX3M/ySfhZdPFkv2mYf7SRaNfu7h5gq8DG3byepPVZef/XdUMZanLw5gbPiH0VNBQ W7OM4uQRdZNWXvCDZ+lbXNNHy8P1v3CcM23dt+HJ/jby31M5JOr7xOS5REXMDgacP5P+ +AP9CWX1o5mTzl+4gKNTSeKCH/l8clzz+1X1GWoMzU/KRkLJK114zpOKA23/vjlY7p3Z tOk1i/u9sRTdt26HnePQWC3t2H0RnzhD5lPtpulXrsRZBwzX/z200mWl4EW4Arsykgcp 8dujVO9JslfkU6LppYkisnjUqzlfXWFwch/5bi06Z6zswpqClT4rEGDihSJ/laoYW1pS RymQ== X-Gm-Message-State: ACrzQf0PZ1q0U3hM+LCNjtsPJFKmZarYY4kdepf5ncWWe3EDDGnaGfk0 7OwJciNkDDbjR1JPRRpay5EcblAHg+A= X-Google-Smtp-Source: AMsMyM4BMAJ9gwxvTnQv10F3jkyLxn/InKjqITZmGqlsxfvxlD/i8krELw5djxqnw1+9VEbMJc5LAQ== X-Received: by 2002:a05:6000:18aa:b0:22a:b61d:877a with SMTP id b10-20020a05600018aa00b0022ab61d877amr5991904wri.512.1664547588400; Fri, 30 Sep 2022 07:19:48 -0700 (PDT) Received: from localhost (92.40.170.30.threembb.co.uk. [92.40.170.30]) by smtp.gmail.com with ESMTPSA id z2-20020a05600c0a0200b003b48dac344esm7481054wmp.43.2022.09.30.07.19.46 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Sep 2022 07:19:47 -0700 (PDT) From: Aidan MacDonald To: ffmpeg-devel@ffmpeg.org Date: Fri, 30 Sep 2022 15:20:09 +0100 Message-Id: <20220930142009.5862-1-aidanmacdonald.0x0@gmail.com> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH] avcodec/dvdsub_parser: Fix length check for short packets X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: The DVD subtitle parser handles two types of packets: "normal" packets with a 16-bit length, and HD-DVD packets that set the 16-bit length to 0 and encode a 32-bit length in the next four bytes. This implies that HD-DVD packets are at least six bytes long, but the code didn't actually verify this. The faulty length check results in an out of bounds read for zero-length "normal" packets that occur in the input, which are only 2 bytes long, but get misinterpreted as an HD-DVD packet. When this happens the parser reads packet_len from beyond the end of the input buffer. The subtitle stream is not correctly decoded after this point due to the garbage packet_len. Fixing this is pretty simple: fix the length check so packets less than 6 bytes long will not be mistakenly parsed as HD-DVD packets. Signed-off-by: Aidan MacDonald --- libavcodec/dvdsub_parser.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/dvdsub_parser.c b/libavcodec/dvdsub_parser.c index 44738a73d6..8871b6a383 100644 --- a/libavcodec/dvdsub_parser.c +++ b/libavcodec/dvdsub_parser.c @@ -43,7 +43,7 @@ static int dvdsub_parse(AVCodecParserContext *s, *poutbuf_size = buf_size; if (pc->packet_index == 0) { - if (buf_size < 2 || AV_RB16(buf) && buf_size < 6) { + if (buf_size < 2 || (AV_RB16(buf) == 0 && buf_size < 6)) { if (buf_size) av_log(avctx, AV_LOG_DEBUG, "Parser input %d too small\n", buf_size); return buf_size; -- 2.35.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".