* [FFmpeg-devel] [PATCH] mov demuxer: Check if a key is longer than the atom containing it
@ 2024-04-01 23:12 Eugene Zemtsov via ffmpeg-devel
2024-04-01 23:18 ` James Almer
0 siblings, 1 reply; 5+ messages in thread
From: Eugene Zemtsov via ffmpeg-devel @ 2024-04-01 23:12 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Eugene Zemtsov, eugene
From: Eugene Zemtsov <eugene@chromium.org>
Stop reading keys and return AVERROR_INVALIDDATA if key_size
is larger than the amount of space left in the atom.
Bug: https://crbug.com/41496983
Signed-off-by: Eugene Zemtsov <eugene@chromium.org>
---
libavformat/mov.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 662301bf67..5d2f7fa690 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5045,15 +5045,18 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom)
if (!c->meta_keys)
return AVERROR(ENOMEM);
+ uint32_t bytes_left_in_atom = atom.size;
for (i = 1; i <= count; ++i) {
uint32_t key_size = avio_rb32(pb);
uint32_t type = avio_rl32(pb);
- if (key_size < 8) {
+ if (key_size < 8 || key_size > bytes_left_in_atom) {
av_log(c->fc, AV_LOG_ERROR,
"The key# %"PRIu32" in meta has invalid size:"
"%"PRIu32"\n", i, key_size);
return AVERROR_INVALIDDATA;
}
+
+ bytes_left_in_atom -= key_size;
key_size -= 8;
if (type != MKTAG('m','d','t','a')) {
avio_skip(pb, key_size);
--
2.44.0.478.gd926399ef9-goog
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [FFmpeg-devel] [PATCH] mov demuxer: Check if a key is longer than the atom containing it
2024-04-01 23:12 [FFmpeg-devel] [PATCH] mov demuxer: Check if a key is longer than the atom containing it Eugene Zemtsov via ffmpeg-devel
@ 2024-04-01 23:18 ` James Almer
2024-04-02 2:28 ` Eugene Zemtsov via ffmpeg-devel
0 siblings, 1 reply; 5+ messages in thread
From: James Almer @ 2024-04-01 23:18 UTC (permalink / raw)
To: ffmpeg-devel
On 4/1/2024 8:12 PM, Eugene Zemtsov via ffmpeg-devel wrote:
> From: Eugene Zemtsov <eugene@chromium.org>
>
> Stop reading keys and return AVERROR_INVALIDDATA if key_size
> is larger than the amount of space left in the atom.
>
> Bug: https://crbug.com/41496983
> Signed-off-by: Eugene Zemtsov <eugene@chromium.org>
> ---
> libavformat/mov.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/mov.c b/libavformat/mov.c
> index 662301bf67..5d2f7fa690 100644
> --- a/libavformat/mov.c
> +++ b/libavformat/mov.c
> @@ -5045,15 +5045,18 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom)
> if (!c->meta_keys)
> return AVERROR(ENOMEM);
>
> + uint32_t bytes_left_in_atom = atom.size;
> for (i = 1; i <= count; ++i) {
> uint32_t key_size = avio_rb32(pb);
> uint32_t type = avio_rl32(pb);
> - if (key_size < 8) {
> + if (key_size < 8 || key_size > bytes_left_in_atom) {
> av_log(c->fc, AV_LOG_ERROR,
> "The key# %"PRIu32" in meta has invalid size:"
> "%"PRIu32"\n", i, key_size);
> return AVERROR_INVALIDDATA;
> }
> +
> + bytes_left_in_atom -= key_size;
atom is a copy and not used anywhere else in this function, so you can
just do atom.size -= key_size and check for that above instead.
> key_size -= 8;
> if (type != MKTAG('m','d','t','a')) {
> avio_skip(pb, key_size);
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [FFmpeg-devel] [PATCH] mov demuxer: Check if a key is longer than the atom containing it
2024-04-01 23:18 ` James Almer
@ 2024-04-02 2:28 ` Eugene Zemtsov via ffmpeg-devel
2024-04-02 2:28 ` Eugene Zemtsov via ffmpeg-devel
0 siblings, 1 reply; 5+ messages in thread
From: Eugene Zemtsov via ffmpeg-devel @ 2024-04-02 2:28 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Eugene Zemtsov, eugene
Thanks for the comments. I got rid of bytes_left_in_atom.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 5+ messages in thread
* [FFmpeg-devel] [PATCH] mov demuxer: Check if a key is longer than the atom containing it
2024-04-02 2:28 ` Eugene Zemtsov via ffmpeg-devel
@ 2024-04-02 2:28 ` Eugene Zemtsov via ffmpeg-devel
2024-04-02 3:18 ` James Almer
0 siblings, 1 reply; 5+ messages in thread
From: Eugene Zemtsov via ffmpeg-devel @ 2024-04-02 2:28 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Eugene Zemtsov, eugene
From: Eugene Zemtsov <eugene@chromium.org>
Stop reading keys and return AVERROR_INVALIDDATA if key_size
is larger than the amount of space left in the atom.
Bug: https://crbug.com/41496983
Signed-off-by: Eugene Zemtsov <eugene@chromium.org>
---
libavformat/mov.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 662301bf67..2d92e7963b 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5048,12 +5048,13 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom)
for (i = 1; i <= count; ++i) {
uint32_t key_size = avio_rb32(pb);
uint32_t type = avio_rl32(pb);
- if (key_size < 8) {
+ if (key_size < 8 || key_size > atom.size) {
av_log(c->fc, AV_LOG_ERROR,
"The key# %"PRIu32" in meta has invalid size:"
"%"PRIu32"\n", i, key_size);
return AVERROR_INVALIDDATA;
}
+ atom.size -= key_size;
key_size -= 8;
if (type != MKTAG('m','d','t','a')) {
avio_skip(pb, key_size);
--
2.44.0.478.gd926399ef9-goog
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [FFmpeg-devel] [PATCH] mov demuxer: Check if a key is longer than the atom containing it
2024-04-02 2:28 ` Eugene Zemtsov via ffmpeg-devel
@ 2024-04-02 3:18 ` James Almer
0 siblings, 0 replies; 5+ messages in thread
From: James Almer @ 2024-04-02 3:18 UTC (permalink / raw)
To: ffmpeg-devel
On 4/1/2024 11:28 PM, Eugene Zemtsov via ffmpeg-devel wrote:
> From: Eugene Zemtsov <eugene@chromium.org>
>
> Stop reading keys and return AVERROR_INVALIDDATA if key_size
> is larger than the amount of space left in the atom.
>
> Bug: https://crbug.com/41496983
> Signed-off-by: Eugene Zemtsov <eugene@chromium.org>
> ---
> libavformat/mov.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/mov.c b/libavformat/mov.c
> index 662301bf67..2d92e7963b 100644
> --- a/libavformat/mov.c
> +++ b/libavformat/mov.c
> @@ -5048,12 +5048,13 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom)
> for (i = 1; i <= count; ++i) {
> uint32_t key_size = avio_rb32(pb);
> uint32_t type = avio_rl32(pb);
> - if (key_size < 8) {
> + if (key_size < 8 || key_size > atom.size) {
> av_log(c->fc, AV_LOG_ERROR,
> "The key# %"PRIu32" in meta has invalid size:"
> "%"PRIu32"\n", i, key_size);
> return AVERROR_INVALIDDATA;
> }
> + atom.size -= key_size;
> key_size -= 8;
> if (type != MKTAG('m','d','t','a')) {
> avio_skip(pb, key_size);
Applied. Thanks.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-04-02 3:18 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-04-01 23:12 [FFmpeg-devel] [PATCH] mov demuxer: Check if a key is longer than the atom containing it Eugene Zemtsov via ffmpeg-devel
2024-04-01 23:18 ` James Almer
2024-04-02 2:28 ` Eugene Zemtsov via ffmpeg-devel
2024-04-02 2:28 ` Eugene Zemtsov via ffmpeg-devel
2024-04-02 3:18 ` James Almer
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git