From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 6F6A3470CF for ; Thu, 27 Jul 2023 02:38:05 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 1DA1168C9C8; Thu, 27 Jul 2023 05:38:03 +0300 (EEST) Received: from bg4.exmail.qq.com (bg4.exmail.qq.com [43.154.54.12]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 219A168C812 for ; Thu, 27 Jul 2023 05:37:55 +0300 (EEST) X-QQ-mid: bizesmtp74t1690425468tj4359x9 Received: from localhost ( [103.102.203.196]) by bizesmtp.qq.com (ESMTP) with id ; Thu, 27 Jul 2023 10:37:46 +0800 (CST) X-QQ-SSF: 01100000000000Z0Z000000A0000000 X-QQ-FEAT: LE7C6P2vL8R280F0jMrzzx3tihbqFIK07v89o15m7vtPb14cyHdam1sfsOWpC ZQTZsX60Qar1fhZH8w02mLruUbAj6tpNLAKJDQqcxzAT4Z0B3VHvdeiinlSjJj0IB6dAMNs v8vpejiznfQ3xEQQBS2zXPIRRuCkUaEHoPxh7Yi/digtO2kjCHSFJN4nV5wVlm6ejBFFqmG jH5LIgUtxKzTyZbY4z5YSf+1ugLFIwb/L6T8D2QXpxefk09unomlHU+scHYVHSqdlipmKL3 oKVUoc/Ci8m+WCKX/4wsRnwFoozc9SFSxnOEN040xjBr14BGft0Wc9JiNzPcoQiqAabZs45 IA0Wc/SVQPsrn4qekXHNdaKecnZRg== X-QQ-GoodBg: 0 X-BIZMAIL-ID: 15733392504575821298 From: Steven Liu To: ffmpeg-devel@ffmpeg.org Date: Thu, 27 Jul 2023 10:37:44 +0800 Message-Id: <20230727023744.20984-1-lq@chinaffmpeg.org> X-Mailer: git-send-email 2.40.0 MIME-Version: 1.0 X-QQ-SENDSIZE: 520 Feedback-ID: bizesmtp:chinaffmpeg.org:qybglogicsvrsz:qybglogicsvrsz3a-0 Subject: [FFmpeg-devel] [PATCH] avformat/flvdec: use avio operation instead of pb->buf_ptr use X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Steven Liu Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: fix segfaults: READ of size 1 at 0x6100000003b7 thread T0 #0 0x7f928d in flv_same_video_codec ffmpeg/libavformat/flvdec.c:317:29 #1 0x7f928d in flv_read_packet ffmpeg/libavformat/flvdec.c:1177 #2 0x6ff32f in ff_read_packet ffmpeg/libavformat/demux.c:575:15 #3 0x70a2fd in read_frame_internal ffmpeg/libavformat/demux.c:1263:15 #4 0x71d158 in avformat_find_stream_info ffmpeg/libavformat/demux.c:2634:15 #5 0x4c821b in LLVMFuzzerTestOneInput ffmpeg/tools/target_dem_fuzzer.c:206:11 Signed-off-by: Steven Liu --- libavformat/flvdec.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index 3fe21622f7..003e4d7691 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -313,8 +313,9 @@ static int flv_same_video_codec(AVFormatContext *s, AVCodecParameters *vpar, int return 1; if (flv->exheader) { - uint8_t *codec_id_str = (uint8_t *)s->pb->buf_ptr; - uint32_t codec_id = codec_id_str[3] | codec_id_str[2] << 8 | codec_id_str[1] << 16 | codec_id_str[0] << 24; + int64_t pos = avio_tell(s->pb); + uint32_t codec_id = avio_rb32(s->pb); + avio_seek(s->pb, pos, SEEK_SET); switch(codec_id) { case MKBETAG('h', 'v', 'c', '1'): return vpar->codec_id == AV_CODEC_ID_HEVC; -- 2.40.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".