From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 2E10D4B065 for ; Wed, 26 Jun 2024 23:50:23 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 0AE5D68D6ED; Thu, 27 Jun 2024 02:50:21 +0300 (EEST) Received: from relay7-d.mail.gandi.net (relay7-d.mail.gandi.net [217.70.183.200]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id DB9BF68D655 for ; Thu, 27 Jun 2024 02:50:13 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 39F2220002 for ; Wed, 26 Jun 2024 23:50:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1719445813; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=y/xHNHBZXT8CExGYLJ104ucGzX4N5azJbHFMfBoYuyc=; b=I9DODB+/6vaOPcrIhBmF5mjSo+9oqHIj1iYL+7Gs/ujnUSdCr0k4liMetLJSWHZnEBi9ec MkJQed+tDNrAomyuUmcB03FlFXABhHinA0W0wm+j9mE0QXegLV8v9E7GpOnYSthZgVZtiY h2Y/4BO1lqHBIh+HKpvbYfIgp31SM9MKhsJv8IETk1rdumbC1Tz4XT66wSNL5GfszQqp/X nZzq1+CaFyDbP8XBMhlTJzdhmlGzrG9duO3vyyD36lyHBdcA5VY0jzFvYXqE60A/eJb/FU bhRsn3npRp12r8SkqBlRUuK7TgDB+1LJmnkN41Ku/7quWcocEWSlWINWDxMEqA== Date: Thu, 27 Jun 2024 01:50:12 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20240626235012.GV4991@pb2> References: <20240322230818.18997-1-michael@niedermayer.cc> <171152515798.7287.8979021106267679923@lain.khirnov.net> <20240327232702.GM6420@pb2> <20240625192546.GG4991@pb2> <171934367519.21847.12248145136761974723@lain.khirnov.net> MIME-Version: 1.0 In-Reply-To: <171934367519.21847.12248145136761974723@lain.khirnov.net> X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [PATCH 1/3] avformat/cafdec: sanity check channels and bps X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============3949510246511977729==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============3949510246511977729== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="V8Y3+xXnhQGsvjWT" Content-Disposition: inline --V8Y3+xXnhQGsvjWT Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Jun 25, 2024 at 09:27:55PM +0200, Anton Khirnov wrote: > Quoting Michael Niedermayer (2024-06-25 21:25:46) > > On Thu, Mar 28, 2024 at 12:27:02AM +0100, Michael Niedermayer wrote: > > > On Wed, Mar 27, 2024 at 08:39:17AM +0100, Anton Khirnov wrote: > > > > Quoting Michael Niedermayer (2024-03-23 00:08:16) > > > > > Fixes: Timeout > > > > > Fixes: 67044/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer= -5791144363491328 > > > > >=20 > > > > > Found-by: continuous fuzzing process https://github.com/google/os= s-fuzz/tree/master/projects/ffmpeg > > > > > Signed-off-by: Michael Niedermayer > > > > > --- > > > > > libavformat/cafdec.c | 5 +++++ > > > > > 1 file changed, 5 insertions(+) > > > > >=20 > > > > > diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c > > > > > index 426c56b9bd..334077efb5 100644 > > > > > --- a/libavformat/cafdec.c > > > > > +++ b/libavformat/cafdec.c > > > > > @@ -33,6 +33,7 @@ > > > > > #include "isom.h" > > > > > #include "mov_chan.h" > > > > > #include "libavcodec/flac.h" > > > > > +#include "libavcodec/internal.h" > > > > > #include "libavutil/intreadwrite.h" > > > > > #include "libavutil/intfloat.h" > > > > > #include "libavutil/dict.h" > > > > > @@ -87,6 +88,10 @@ static int read_desc_chunk(AVFormatContext *s) > > > > > st->codecpar->ch_layout.nb_channels =3D avio_rb32(pb); > > > > > st->codecpar->bits_per_coded_sample =3D avio_rb32(pb); > > > > > =20 > > > > > + if (st->codecpar->ch_layout.nb_channels > FF_SANE_NB_CHANNEL= S || > > > >=20 > > > > I dislike this. > > >=20 > > > I dislike it too > >=20 > > so what do we do about this ? >=20 > About what? What is the actual problem that needs addressed? 67044/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5791144363491328 >=20 > > any objections to apply this ? >=20 > yes, FF_SANE_NB_CHANNELS is a hack that should be removed, not spread a maximum number for each theoretically unlimited parameter is desirable This can be a user setable value or a compile time value when such is prefe= rred. We can take this to the TC if you want. The same way as the number of files or number of bytes used by some cache needs limits, so do channels, and number of pixels. One can remove them but users and companies concious about security and efficiency with untrusted input in an (semi-) automated environment will li= kely choose the codebase providing such features. thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB The day soldiers stop bringing you their problems is the day you have stopp= ed=20 leading them. They have either lost confidence that you can help or conclud= ed=20 you do not care. Either case is a failure of leadership. - Colin Powell --V8Y3+xXnhQGsvjWT Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEKAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCZnypMAAKCRBhHseHBAsP q9CaAJ0S+h94ROO1RwMBu86W2wUnEPAREQCff6dUibannzjf1rA+gSeWCqI1+mM= =ERMH -----END PGP SIGNATURE----- --V8Y3+xXnhQGsvjWT-- --===============3949510246511977729== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============3949510246511977729==--