From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id D7A8E48988 for ; Wed, 21 Feb 2024 17:27:39 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 37B0F68D16B; Wed, 21 Feb 2024 19:27:37 +0200 (EET) Received: from relay8-d.mail.gandi.net (relay8-d.mail.gandi.net [217.70.183.201]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id DC5D468D0CE for ; Wed, 21 Feb 2024 19:27:30 +0200 (EET) Received: by mail.gandi.net (Postfix) with ESMTPSA id 0219C1BF206 for ; Wed, 21 Feb 2024 17:27:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1708536450; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=DewgY5FuEBJvIQ4wOPkUtTkfLdlFCIGXIBd9XJOAlps=; b=lNy4yZ3gCt608lmvEci5hVTdgXCp31LgPtwicD7s3AdsUg0GHMbGbfqQMomDxNvONWBKhC VFkBkvdF6/HqsQROIfpMUS0WlhsF/g+J38iTW/Edf87ugZW/FymEw9Nnq/HXkJcZV6fALS fNst62cu8S/rRF2pPN3vDfNN91xfa/Af76r4COC/DvvsoJsypeP2yMjTq4TtMv4MvKCMjv RASEQwyaW0gHz1luvmcYBYQ/One0ANQZ9Kz310cGmcysILztajjYBHI7J1Zj2Ys2H/mraj w7G+sBJTtzRjmEF2d206hsTdv9qdOXc0IfFSok2CO9b9geIKuJbKyX6LUEwzCQ== Date: Wed, 21 Feb 2024 18:27:29 +0100 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20240221172729.GB6420@pb2> References: <20240205200736.GS6420@pb2> <20240215223534.GH6420@pb2> MIME-Version: 1.0 In-Reply-To: X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [PATCH] [mov] Avoid OOM for invalid STCO / CO64 constructions. X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============6137728953738665722==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============6137728953738665722== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="00cWtV2etiRJew8R" Content-Disposition: inline --00cWtV2etiRJew8R Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Feb 16, 2024 at 01:41:35PM -0800, Dale Curtis wrote: > On Thu, Feb 15, 2024 at 2:35=E2=80=AFPM Michael Niedermayer > wrote: >=20 > > FFMIN/MAX can evaluate their arguments multiple times so avio_rb32() mi= ght > > be executed more than once > > >=20 > Thanks. Good catch. Fixed. > mov.c | 7 +++++++ > 1 file changed, 7 insertions(+) > 08ba396380cc14f3df2bdd4a638c43c1c521b8fc stco-clamp-entries-v4.patch > From b94e542582e375025c59862cee58ec45d39c9cd6 Mon Sep 17 00:00:00 2001 > From: Dale Curtis > Date: Fri, 2 Feb 2024 20:49:44 +0000 > Subject: [PATCH] [mov] Avoid OOM for invalid STCO / CO64 constructions. >=20 > The `entries` value is read directly from the stream and used to > allocate memory. This change clamps `entries` to however many are > possible in the remaining atom or file size (whichever is smallest). >=20 > Fixes https://crbug.com/1429357 >=20 > Signed-off-by: Dale Curtis > --- > libavformat/mov.c | 7 +++++++ > 1 file changed, 7 insertions(+) will apply thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB It is a danger to trust the dream we wish for rather than the science we have, -- Dr. Kenneth Brown --00cWtV2etiRJew8R Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEIAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCZdYyegAKCRBhHseHBAsP q44zAJ9seIrVYxJwmm0pHScM8tRUJiONjQCfcGMiGYWTjrhK4vsG59m5FVW+zpM= =g0Vr -----END PGP SIGNATURE----- --00cWtV2etiRJew8R-- --===============6137728953738665722== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============6137728953738665722==--