From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 6593F4690D for ; Sat, 24 Jun 2023 20:06:30 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 4C47868C0CC; Sat, 24 Jun 2023 23:06:26 +0300 (EEST) Received: from relay7-d.mail.gandi.net (relay7-d.mail.gandi.net [217.70.183.200]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 6266A68BFE0 for ; Sat, 24 Jun 2023 23:06:20 +0300 (EEST) X-GND-Sasl: michael@niedermayer.cc X-GND-Sasl: michael@niedermayer.cc Received: by mail.gandi.net (Postfix) with ESMTPSA id 9E06620005; Sat, 24 Jun 2023 20:06:18 +0000 (UTC) Date: Sat, 24 Jun 2023 22:06:17 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20230624200617.GV3250409@pb2> References: <20230622003038.20969-1-michael@niedermayer.cc> MIME-Version: 1.0 In-Reply-To: Subject: Re: [FFmpeg-devel] [PATCH] avcodec/parser: Check next against buffer index X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Reimar =?iso-8859-1?Q?D=F6ffinger?= Content-Type: multipart/mixed; boundary="===============4423701047393131413==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============4423701047393131413== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="59coWm5189RNS6mf" Content-Disposition: inline --59coWm5189RNS6mf Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Jun 24, 2023 at 09:14:53PM +0200, Andreas Rheinhardt wrote: > Michael Niedermayer: > > Fixes: out of array access > > Fixes: crash-0d640731c7da52415670eb47a2af701cbe2e1a3b > >=20 > > Found-by: Catena cyber > > Signed-off-by: Michael Niedermayer > > --- > > libavcodec/parser.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > >=20 > > diff --git a/libavcodec/parser.c b/libavcodec/parser.c > > index efc28b8918..db39e698ab 100644 > > --- a/libavcodec/parser.c > > +++ b/libavcodec/parser.c > > @@ -214,7 +214,7 @@ int ff_combine_frame(ParseContext *pc, int next, > > for (; pc->overread > 0; pc->overread--) > > pc->buffer[pc->index++] =3D pc->buffer[pc->overread_index++]; > > =20 > > - if (next > *buf_size) > > + if (next > *buf_size || (next < -pc->index && next !=3D END_NOT_FO= UND)) > > return AVERROR(EINVAL); > > =20 > > /* flush remaining if EOF */ >=20 > Could you provide more details about this? E.g. which parser is this > about at all? And how can we actually come in this situation at all? > (Whenever I looked at ff_combine_frame() I do not really understand what > its invariants are supposed to be.) truehd with a malloc() failure and i dont think it should happen but, it felt like a good idea to check also *buf_size should probably be reset to 0, there was a patch about that =66rom reimar (in CC) thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Frequently ignored answer#1 FFmpeg bugs should be sent to our bugtracker. U= ser questions about the command line tools should be sent to the ffmpeg-user ML. And questions about how to use libav* should be sent to the libav-user ML. --59coWm5189RNS6mf Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEIAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCZJdMrQAKCRBhHseHBAsP q0iZAJ4nIe3jwQ2VPn5j39Psce1svaxfKQCgktoh82Uajzy70HRl2LuNJyX7Ly4= =FKHY -----END PGP SIGNATURE----- --59coWm5189RNS6mf-- --===============4423701047393131413== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============4423701047393131413==--