Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
 help / color / mirror / Atom feed
* [FFmpeg-devel] [PATCH 1/5] avcodec/evc_frame_merge: ensure the assembled buffer fits in an AVPacket
@ 2023-06-22 19:29 James Almer
  2023-06-22 19:29 ` [FFmpeg-devel] [PATCH 2/5] avformat/evc: remove unnecessary struct James Almer
                   ` (6 more replies)
  0 siblings, 7 replies; 9+ messages in thread
From: James Almer @ 2023-06-22 19:29 UTC (permalink / raw)
  To: ffmpeg-devel

Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavcodec/evc_frame_merge_bsf.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/libavcodec/evc_frame_merge_bsf.c b/libavcodec/evc_frame_merge_bsf.c
index 121f93c0b0..3e1258c6c9 100644
--- a/libavcodec/evc_frame_merge_bsf.c
+++ b/libavcodec/evc_frame_merge_bsf.c
@@ -199,8 +199,16 @@ static int evc_frame_merge_filter(AVBSFContext *bsf, AVPacket *out)
         au_end_found = err;
 
         nalu_size += EVC_NALU_LENGTH_PREFIX_SIZE;
+
+        data_size = ctx->au_buffer.data_size + nalu_size;
+        if (data_size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) {
+            av_log(bsf, AV_LOG_ERROR, "Assembled packet is too big\n");
+            err = AVERROR(ERANGE);
+            goto end;
+        }
+
         buffer = av_fast_realloc(ctx->au_buffer.data, &ctx->au_buffer.capacity,
-                                 ctx->au_buffer.data_size + nalu_size);
+                                 data_size);
         if (!buffer) {
             av_freep(&ctx->au_buffer.data);
             err = AVERROR_INVALIDDATA;
@@ -210,7 +218,7 @@ static int evc_frame_merge_filter(AVBSFContext *bsf, AVPacket *out)
         ctx->au_buffer.data = buffer;
         memcpy(ctx->au_buffer.data + ctx->au_buffer.data_size, in->data, nalu_size);
 
-        ctx->au_buffer.data_size += nalu_size;
+        ctx->au_buffer.data_size = data_size;
 
         in->data += nalu_size;
         in->size -= nalu_size;
-- 
2.41.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2023-06-27 10:06 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-06-22 19:29 [FFmpeg-devel] [PATCH 1/5] avcodec/evc_frame_merge: ensure the assembled buffer fits in an AVPacket James Almer
2023-06-22 19:29 ` [FFmpeg-devel] [PATCH 2/5] avformat/evc: remove unnecessary struct James Almer
2023-06-22 19:29 ` [FFmpeg-devel] [PATCH 3/5] avformat/evc: remove duplicate check James Almer
2023-06-22 19:29 ` [FFmpeg-devel] [PATCH 4/5] avformat/evc: add range checks to evcc_parse_sps and return proper error codes James Almer
2023-06-22 19:29 ` [FFmpeg-devel] [PATCH 5/5] avformat/evc: remove duplicate defines James Almer
2023-06-22 22:48 ` [FFmpeg-devel] [PATCH 6/7] avcodec/evc_parse: use unsigned types in structs where corresponds James Almer
2023-06-22 22:48 ` [FFmpeg-devel] [PATCH 7/7] avcodec/evc_ps: " James Almer
2023-06-23 11:43 ` [FFmpeg-devel] [PATCH 1/5] avcodec/evc_frame_merge: ensure the assembled buffer fits in an AVPacket James Almer
2023-06-27 10:06   ` Dawid Kozinski/Multimedia (PLT) /SRPOL/Staff Engineer/Samsung Electronics

Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
		ffmpegdev@gitmailbox.com
	public-inbox-index ffmpegdev

Example config snippet for mirrors.


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git