From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 6785A46712 for ; Thu, 8 Jun 2023 00:20:44 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 4563D68B1C4; Thu, 8 Jun 2023 03:20:41 +0300 (EEST) Received: from relay9-d.mail.gandi.net (relay9-d.mail.gandi.net [217.70.183.199]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id A388268BFA0 for ; Thu, 8 Jun 2023 03:20:34 +0300 (EEST) X-GND-Sasl: michael@niedermayer.cc Received: by mail.gandi.net (Postfix) with ESMTPSA id F0173FF804 for ; Thu, 8 Jun 2023 00:20:33 +0000 (UTC) Date: Thu, 8 Jun 2023 02:20:33 +0200 From: Michael Niedermayer To: ffmpeg-devel@ffmpeg.org Message-ID: <20230608002033.GF870501@pb2> References: <20230605161533.5C3904107D6@natalya.videolan.org> MIME-Version: 1.0 In-Reply-To: <20230605161533.5C3904107D6@natalya.videolan.org> X-Spam-Flag: yes X-Spam-Level: ******************** X-GND-Spam-Score: 310 X-GND-Status: SPAM Subject: Re: [FFmpeg-devel] [FFmpeg-cvslog] avformat/jpegxl_anim_dec: add animated JPEG XL demuxer X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============2454987202741002970==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============2454987202741002970== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="ffoCPvUAPMgSXi6H" Content-Disposition: inline --ffoCPvUAPMgSXi6H Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Jun 05, 2023 at 04:15:32PM +0000, Leo Izen wrote: > ffmpeg | branch: master | Leo Izen | Fri Mar 3 15:3= 1:46 2023 -0500| [fa11c4c7fa3961b0101daaa0032bb26a7a1a9c0f] | committer: Le= o Izen >=20 > avformat/jpegxl_anim_dec: add animated JPEG XL demuxer >=20 > Animated JPEG XL files requires a separate demuxer than image2, because > the timebase information is set by the demuxer. Should the timebase of > an animated JPEG XL file be incompatible with the timebase set by the > image2pipe demuxer (usually 1/25 unless set otherwise), rescaling will > fail. Adding a separate demuxer for animated JPEG XL files allows the > timebase to be set correctly. >=20 > Signed-off-by: Leo Izen >=20 > > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=3Dcommit;h=3Dfa11c4c7f= a3961b0101daaa0032bb26a7a1a9c0f > --- [...] > +/* > + * copies as much of the codestream into the buffer as possible > + * pass a shorter buflen to request less > + * returns the number of bytes consumed from input, may be greater than = input_len > + * if the input doesn't end on an ISOBMFF-box boundary > + */ > +static int jpegxl_collect_codestream_header(const uint8_t *input_buffer,= int input_len, uint8_t *buffer, int buflen, int *copied) { > + const uint8_t *b =3D input_buffer; > + *copied =3D 0; > + > + while (1) { > + uint64_t size; > + uint32_t tag; > + int head_size =3D 8; > + > + if (b - input_buffer >=3D input_len - 16) > + break; > + > + size =3D AV_RB32(b); > + b +=3D 4; > + if (size =3D=3D 1) { > + size =3D AV_RB64(b); > + b +=3D 8; > + head_size =3D 16; > + } > + /* invalid ISOBMFF size */ > + if (size > 0 && size <=3D head_size) > + return AVERROR_INVALIDDATA; > + if (size > 0) > + size -=3D head_size; > + > + tag =3D AV_RL32(b); > + b +=3D 4; > + if (tag =3D=3D MKTAG('j', 'x', 'l', 'p')) { > + b +=3D 4; > + size -=3D 4; > + } This checks that there are 17 bytes but then advances by 20 (4+8+4+4) It checks if uint64_t size is not 0 then even if 0 subtracts 4, 6 lines lat= er and a few lines later below adds size with no checks to a pointer Pointers must stay valid, its undefined behavior to move a pointer beyond the end of the allocated space, even if its not dereferenced. Even if it wasnt undefined this would not be safe because it could go over the end of addressspace thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB If you drop bombs on a foreign country and kill a hundred thousand innocent people, expect your government to call the consequence "unprovoked inhuman terrorist attacks" and use it to justify dropping more bombs and killing more people. The technology changed, the idea is old. --ffoCPvUAPMgSXi6H Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEIAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCZIEezAAKCRBhHseHBAsP q5LEAJ0d8VYue7cYXKok/sdAL5dJv1ohdQCeIYVUkdmiiwlGPCOnq012S6z9J2Y= =CzSY -----END PGP SIGNATURE----- --ffoCPvUAPMgSXi6H-- --===============2454987202741002970== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============2454987202741002970==--