From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 38150470D9 for ; Thu, 27 Jul 2023 07:32:01 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id E10DE68C9EB; Thu, 27 Jul 2023 10:31:58 +0300 (EEST) Received: from bg4.exmail.qq.com (bg4.exmail.qq.com [43.154.54.12]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 63C0368C9BF for ; Thu, 27 Jul 2023 10:31:51 +0300 (EEST) X-QQ-mid: bizesmtp76t1690443105tm9aew9d Received: from localhost ( [103.102.203.196]) by bizesmtp.qq.com (ESMTP) with id ; Thu, 27 Jul 2023 15:31:44 +0800 (CST) X-QQ-SSF: 01100000000000Z0Z000000A0000000 X-QQ-FEAT: 0vfWcIgh24y6ZUve1FYsByQ8Ti1gZ3WjXpcjneIi6hiU/Klf5sqhd1mpsX1e1 UmSxt1QX3xWhYZ63aQearyuk+VluLu3McNpnCa30wrq9SdunsbFle93Ju6Rlw7tTfF8rzsh dl1+bqfDrICX1QoUwICF5j8GJjTUjFp4+EdXh68cjb1PhM2wzckE0IM8GZaT8nDyCe9N0cP GAuGCliBKc5xDbpSAo0aIjfycuOth4j0IBeRdKQz/cvzsKExaEF1hx7CrjqM0hPCtIDEBw3 W7Ir0mUy7ckS/83tQcRavLKxHdfhMvvpB/l5d5f82dBy6E6IfRR5BvQtTm41gsHQp7KkZhy l6GsnIOLo5iYxdUnygd6idRJtkH3EmGQV3RmfzHtBxYVkXegiQ= X-QQ-GoodBg: 0 X-BIZMAIL-ID: 10649776815798364184 From: Steven Liu To: ffmpeg-devel@ffmpeg.org Date: Thu, 27 Jul 2023 15:31:42 +0800 Message-Id: <20230727073142.64813-1-lq@chinaffmpeg.org> X-Mailer: git-send-email 2.40.0 In-Reply-To: References: MIME-Version: 1.0 X-QQ-SENDSIZE: 520 Feedback-ID: bizesmtp:chinaffmpeg.org:qybglogicsvrsz:qybglogicsvrsz3a-0 Subject: [FFmpeg-devel] [PATCH v2] avformat/flvdec: use avio operation instead of pb->buf_ptr use X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Steven Liu Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: check ensure seekback 4 bytes before read 4 bytes from pb, and seek back 4 byte from current position after read 4 bytes. fix segfaults: READ of size 1 at 0x6100000003b7 thread T0 #0 0x7f928d in flv_same_video_codec ffmpeg/libavformat/flvdec.c:317:29 #1 0x7f928d in flv_read_packet ffmpeg/libavformat/flvdec.c:1177 #2 0x6ff32f in ff_read_packet ffmpeg/libavformat/demux.c:575:15 #3 0x70a2fd in read_frame_internal ffmpeg/libavformat/demux.c:1263:15 #4 0x71d158 in avformat_find_stream_info ffmpeg/libavformat/demux.c:2634:15 #5 0x4c821b in LLVMFuzzerTestOneInput ffmpeg/tools/target_dem_fuzzer.c:206:11 Signed-off-by: Steven Liu --- libavformat/flvdec.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index 3fe21622f7..38f34567dd 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -35,6 +35,7 @@ #include "libavutil/intreadwrite.h" #include "libavutil/mathematics.h" #include "avformat.h" +#include "avio_internal.h" #include "demux.h" #include "internal.h" #include "flv.h" @@ -313,8 +314,14 @@ static int flv_same_video_codec(AVFormatContext *s, AVCodecParameters *vpar, int return 1; if (flv->exheader) { - uint8_t *codec_id_str = (uint8_t *)s->pb->buf_ptr; - uint32_t codec_id = codec_id_str[3] | codec_id_str[2] << 8 | codec_id_str[1] << 16 | codec_id_str[0] << 24; + uint32_t codec_id = 0; + int ret = ffio_ensure_seekback(s->pb, 4); + if (ret < 0) { + av_log(s, AV_LOG_WARNING, "Could not ensure seekback, because %s", av_err2str(ret)); + return 0; + } + codec_id = avio_rb32(s->pb); + avio_seek(s->pb, -4, SEEK_CUR); switch(codec_id) { case MKBETAG('h', 'v', 'c', '1'): return vpar->codec_id == AV_CODEC_ID_HEVC; -- 2.40.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".