* [FFmpeg-devel] [PATCH] avformat/mxfdec: Check that edit_unit_byte_count is not negative
@ 2024-04-01 16:08 Michael Niedermayer
2024-04-01 16:22 ` Marton Balint
0 siblings, 1 reply; 5+ messages in thread
From: Michael Niedermayer @ 2024-04-01 16:08 UTC (permalink / raw)
To: FFmpeg development discussions and patches
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mxfdec.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index e484db052ef..37446963369 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -1245,9 +1245,13 @@ static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *seg
static int mxf_read_index_table_segment(void *arg, AVIOContext *pb, int tag, int size, UID uid, int64_t klv_offset)
{
MXFIndexTableSegment *segment = arg;
+ int tmp;
switch(tag) {
case 0x3F05:
- segment->edit_unit_byte_count = avio_rb32(pb);
+ tmp = avio_rb32(pb);
+ if (tmp < 0)
+ return AVERROR_INVALIDDATA;
+ segment->edit_unit_byte_count = tmp;
av_log(NULL, AV_LOG_TRACE, "EditUnitByteCount %d\n", segment->edit_unit_byte_count);
break;
case 0x3F06:
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [FFmpeg-devel] [PATCH] avformat/mxfdec: Check that edit_unit_byte_count is not negative
2024-04-01 16:08 [FFmpeg-devel] [PATCH] avformat/mxfdec: Check that edit_unit_byte_count is not negative Michael Niedermayer
@ 2024-04-01 16:22 ` Marton Balint
2024-04-01 16:26 ` Michael Niedermayer
2024-04-03 8:24 ` Tomas Härdin
0 siblings, 2 replies; 5+ messages in thread
From: Marton Balint @ 2024-04-01 16:22 UTC (permalink / raw)
To: FFmpeg development discussions and patches
On Mon, 1 Apr 2024, Michael Niedermayer wrote:
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavformat/mxfdec.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> index e484db052ef..37446963369 100644
> --- a/libavformat/mxfdec.c
> +++ b/libavformat/mxfdec.c
> @@ -1245,9 +1245,13 @@ static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *seg
> static int mxf_read_index_table_segment(void *arg, AVIOContext *pb, int tag, int size, UID uid, int64_t klv_offset)
> {
> MXFIndexTableSegment *segment = arg;
> + int tmp;
> switch(tag) {
> case 0x3F05:
> - segment->edit_unit_byte_count = avio_rb32(pb);
Why not simply make segment->edit_unit_byte_count unsigned?
Thanks,
Marton
> + tmp = avio_rb32(pb);
> + if (tmp < 0)
> + return AVERROR_INVALIDDATA;
> + segment->edit_unit_byte_count = tmp;
> av_log(NULL, AV_LOG_TRACE, "EditUnitByteCount %d\n", segment->edit_unit_byte_count);
> break;
> case 0x3F06:
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [FFmpeg-devel] [PATCH] avformat/mxfdec: Check that edit_unit_byte_count is not negative
2024-04-01 16:22 ` Marton Balint
@ 2024-04-01 16:26 ` Michael Niedermayer
2024-04-03 8:24 ` Tomas Härdin
1 sibling, 0 replies; 5+ messages in thread
From: Michael Niedermayer @ 2024-04-01 16:26 UTC (permalink / raw)
To: FFmpeg development discussions and patches
[-- Attachment #1.1: Type: text/plain, Size: 1172 bytes --]
On Mon, Apr 01, 2024 at 06:22:47PM +0200, Marton Balint wrote:
>
>
> On Mon, 1 Apr 2024, Michael Niedermayer wrote:
>
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> > libavformat/mxfdec.c | 6 +++++-
> > 1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> > index e484db052ef..37446963369 100644
> > --- a/libavformat/mxfdec.c
> > +++ b/libavformat/mxfdec.c
> > @@ -1245,9 +1245,13 @@ static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *seg
> > static int mxf_read_index_table_segment(void *arg, AVIOContext *pb, int tag, int size, UID uid, int64_t klv_offset)
> > {
> > MXFIndexTableSegment *segment = arg;
> > + int tmp;
> > switch(tag) {
> > case 0x3F05:
> > - segment->edit_unit_byte_count = avio_rb32(pb);
>
> Why not simply make segment->edit_unit_byte_count unsigned?
ok will apply that instead
thx
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
I do not agree with what you have to say, but I'll defend to the death your
right to say it. -- Voltaire
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
[-- Attachment #2: Type: text/plain, Size: 251 bytes --]
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [FFmpeg-devel] [PATCH] avformat/mxfdec: Check that edit_unit_byte_count is not negative
2024-04-01 16:22 ` Marton Balint
2024-04-01 16:26 ` Michael Niedermayer
@ 2024-04-03 8:24 ` Tomas Härdin
2024-04-03 19:08 ` Marton Balint
1 sibling, 1 reply; 5+ messages in thread
From: Tomas Härdin @ 2024-04-03 8:24 UTC (permalink / raw)
To: FFmpeg development discussions and patches
mån 2024-04-01 klockan 18:22 +0200 skrev Marton Balint:
>
>
> On Mon, 1 Apr 2024, Michael Niedermayer wrote:
>
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> > libavformat/mxfdec.c | 6 +++++-
> > 1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> > index e484db052ef..37446963369 100644
> > --- a/libavformat/mxfdec.c
> > +++ b/libavformat/mxfdec.c
> > @@ -1245,9 +1245,13 @@ static int
> > mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment
> > *seg
> > static int mxf_read_index_table_segment(void *arg, AVIOContext *pb,
> > int tag, int size, UID uid, int64_t klv_offset)
> > {
> > MXFIndexTableSegment *segment = arg;
> > + int tmp;
> > switch(tag) {
> > case 0x3F05:
> > - segment->edit_unit_byte_count = avio_rb32(pb);
>
> Why not simply make segment->edit_unit_byte_count unsigned?
This might run afoul with various calcultions. Speaking of,
mxf_edit_unit_absolute_offset() does not check for multiplication
overflows..
/Tomas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [FFmpeg-devel] [PATCH] avformat/mxfdec: Check that edit_unit_byte_count is not negative
2024-04-03 8:24 ` Tomas Härdin
@ 2024-04-03 19:08 ` Marton Balint
0 siblings, 0 replies; 5+ messages in thread
From: Marton Balint @ 2024-04-03 19:08 UTC (permalink / raw)
To: FFmpeg development discussions and patches
On Wed, 3 Apr 2024, Tomas Härdin wrote:
> mån 2024-04-01 klockan 18:22 +0200 skrev Marton Balint:
>>
>>
>> On Mon, 1 Apr 2024, Michael Niedermayer wrote:
>>
>> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
>> > ---
>> > libavformat/mxfdec.c | 6 +++++-
>> > 1 file changed, 5 insertions(+), 1 deletion(-)
>> >
>> > diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
>> > index e484db052ef..37446963369 100644
>> > --- a/libavformat/mxfdec.c
>> > +++ b/libavformat/mxfdec.c
>> > @@ -1245,9 +1245,13 @@ static int
>> > mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment
>> > *seg
>> > static int mxf_read_index_table_segment(void *arg, AVIOContext *pb,
>> > int tag, int size, UID uid, int64_t klv_offset)
>> > {
>> > MXFIndexTableSegment *segment = arg;
>> > + int tmp;
>> > switch(tag) {
>> > case 0x3F05:
>> > - segment->edit_unit_byte_count = avio_rb32(pb);
>>
>> Why not simply make segment->edit_unit_byte_count unsigned?
>
> This might run afoul with various calcultions. Speaking of,
> mxf_edit_unit_absolute_offset() does not check for multiplication
> overflows..
Michael's earlier patch fixed that, and the fix should work for both
signed and unsigned.
Regards,
Marton
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-04-03 19:08 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-04-01 16:08 [FFmpeg-devel] [PATCH] avformat/mxfdec: Check that edit_unit_byte_count is not negative Michael Niedermayer
2024-04-01 16:22 ` Marton Balint
2024-04-01 16:26 ` Michael Niedermayer
2024-04-03 8:24 ` Tomas Härdin
2024-04-03 19:08 ` Marton Balint
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git