From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <ffmpeg-devel-bounces@ffmpeg.org>
Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100])
by master.gitmailbox.com (Postfix) with ESMTPS id ACA3D4CE81
for <ffmpegdev@gitmailbox.com>; Mon, 14 Apr 2025 23:20:02 +0000 (UTC)
Received: from [127.0.1.1] (localhost [127.0.0.1])
by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id D5997687C91;
Tue, 15 Apr 2025 02:19:58 +0300 (EEST)
Received: from relay3-d.mail.gandi.net (relay3-d.mail.gandi.net
[217.70.183.195])
by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id ADD66687C89
for <ffmpeg-devel@ffmpeg.org>; Tue, 15 Apr 2025 02:19:52 +0300 (EEST)
Received: by mail.gandi.net (Postfix) with ESMTPSA id 076521FCE6
for <ffmpeg-devel@ffmpeg.org>; Mon, 14 Apr 2025 23:19:51 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc;
s=gm1; t=1744672792;
h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
in-reply-to:in-reply-to:references:references;
bh=byw35azYRXkoysDQTy0iGzYCsGjC/CXLxZTVZtSvv1g=;
b=hBs8QMEaog2Q0jsic+eAW668+dK4apLTgJ3AcTG0L57uD6URQwBDCa+1qh3JjaZs0GNfhC
wI8mWUoayscFij8AdlxZuqQ3WPvwgQW2j5eRWJjzc6zARKKUxagmo891pnG4iXajbUmBSM
X+drMlRULhjy4LpmzdPyhEmfPCrAoo50knYKAl4zKIDAe0LHYvXQTh41HRB7f7ZgytzIka
PBCI23EcZ27HatsQW3KczOF75Tr2HbJh1QXRHGvlTQvq46gvEtMH6+EAlOwCNXYL8MIbHp
EjJ/1dm6R3AH1JvJCtmugF0WaPDjxK1U1bvZSWA56Z2tPqi6aK3G23WmU7nPaQ==
Date: Tue, 15 Apr 2025 01:19:50 +0200
From: Michael Niedermayer <michael@niedermayer.cc>
To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Message-ID: <20250414231950.GN4991@pb2>
References: <20250411222719.2779176-1-michael@niedermayer.cc>
<20250411222719.2779176-2-michael@niedermayer.cc>
<DM8P223MB0365A90C10FBC9EF6512F9E1BAB12@DM8P223MB0365.NAMP223.PROD.OUTLOOK.COM>
MIME-Version: 1.0
In-Reply-To: <DM8P223MB0365A90C10FBC9EF6512F9E1BAB12@DM8P223MB0365.NAMP223.PROD.OUTLOOK.COM>
X-GND-State: clean
X-GND-Score: -85
X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgddvvddukeehucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuifetpfffkfdpucggtfgfnhhsuhgsshgtrhhisggvnecuuegrihhlohhuthemuceftddunecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenfghrlhcuvffnffculdduhedmnecujfgurhepfffhvffukfhfgggtuggjsehgtderredttddvnecuhfhrohhmpefoihgthhgrvghlucfpihgvuggvrhhmrgihvghruceomhhitghhrggvlhesnhhivgguvghrmhgrhigvrhdrtggtqeenucggtffrrghtthgvrhhnpeffledtfeevfeffheeuuefhtdejieelueeftdeitdfgheetgefffeefteekffdthfenucffohhmrghinhepfhhfmhhpvghgrdhorhhgnecukfhppeeguddrieeirdeijedruddufeenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpeeguddrieeirdeijedruddufedphhgvlhhopehlohgtrghlhhhoshhtpdhmrghilhhfrhhomhepmhhitghhrggvlhesnhhivgguvghrmhgrhigvrhdrtggtpdhnsggprhgtphhtthhopedupdhrtghpthhtohepfhhfmhhpvghgqdguvghvvghlsehffhhmphgvghdrohhrgh
X-GND-Sasl: michael@niedermayer.cc
Subject: Re: [FFmpeg-devel] [PATCH 2/2] avformat/id3v2: Check that
decode_str() did advance
X-BeenThere: ffmpeg-devel@ffmpeg.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: FFmpeg development discussions and patches <ffmpeg-devel.ffmpeg.org>
List-Unsubscribe: <https://ffmpeg.org/mailman/options/ffmpeg-devel>,
<mailto:ffmpeg-devel-request@ffmpeg.org?subject=unsubscribe>
List-Archive: <https://ffmpeg.org/pipermail/ffmpeg-devel>
List-Post: <mailto:ffmpeg-devel@ffmpeg.org>
List-Help: <mailto:ffmpeg-devel-request@ffmpeg.org?subject=help>
List-Subscribe: <https://ffmpeg.org/mailman/listinfo/ffmpeg-devel>,
<mailto:ffmpeg-devel-request@ffmpeg.org?subject=subscribe>
Reply-To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Content-Type: multipart/mixed; boundary="===============5578092762150430559=="
Errors-To: ffmpeg-devel-bounces@ffmpeg.org
Sender: "ffmpeg-devel" <ffmpeg-devel-bounces@ffmpeg.org>
Archived-At: <https://master.gitmailbox.com/ffmpegdev/20250414231950.GN4991@pb2/>
List-Archive: <https://master.gitmailbox.com/ffmpegdev/>
List-Post: <mailto:ffmpegdev@gitmailbox.com>
--===============5578092762150430559==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature"; boundary="QIrx+3S6pmSJvScj"
Content-Disposition: inline
--QIrx+3S6pmSJvScj
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Sat, Apr 12, 2025 at 01:49:53AM +0000, softworkz . wrote:
>=20
>=20
> > -----Original Message-----
> > From: ffmpeg-devel <ffmpeg-devel-bounces@ffmpeg.org> On Behalf Of
> > Michael Niedermayer
> > Sent: Samstag, 12. April 2025 00:27
> > To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
> > Subject: [FFmpeg-devel] [PATCH 2/2] avformat/id3v2: Check that
> > decode_str() did advance
> >=20
> > Fixes infinite loop with unknown encodings
> >=20
> > We could alternatively error out from decode_str() or consume all of
> > taglen
> > this would affect other callers though.
> >=20
> > Fixes: 409819224/clusterfuzz-testcase-minimized-ffmpeg_dem_H261_fuzzer-
> > 6003527535362048
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> > libavformat/id3v2.c | 3 +++
> > 1 file changed, 3 insertions(+)
> >=20
> > diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c
> > index 90314583a74..e3f7f9e2a90 100644
> > --- a/libavformat/id3v2.c
> > +++ b/libavformat/id3v2.c
> > @@ -341,10 +341,13 @@ static void read_ttag(AVFormatContext *s,
> > AVIOContext *pb, int taglen,
> > taglen--; /* account for encoding type byte */
> >=20
> > while (taglen > 1) {
> > + int current_taglen =3D taglen;
> > if (decode_str(s, pb, encoding, &dst, &taglen) < 0) {
> > av_log(s, AV_LOG_ERROR, "Error reading frame %s,
> > skipped\n", key);
> > return;
> > }
> > + if (current_taglen =3D=3D taglen)
> > + return;
> >=20
> > count++;
> >=20
> > --
> > 2.49.0
> >=20
> > _______________________________________________
>=20
> Hi Michael,
>=20
> this kind of conflicts with this patch that I had submitted recently:
>=20
> https://patchwork.ffmpeg.org/project/ffmpeg/patch/pull.54.ffstaging.FFmpe=
g.1740873449247.ffmpegagent@gmail.com/
>=20
>=20
> I wonder whether my patch would still be prone to the issue your patch is=
addressing -
This already conflicts with rcombs patch in git master, i think
Applying: Fixes Trac ticket https://trac.ffmpeg.org/ticket/6949
Using index info to reconstruct a base tree...
M libavformat/id3v2.c
Falling back to patching base and 3-way merge...
Auto-merging libavformat/id3v2.c
CONFLICT (content): Merge conflict in libavformat/id3v2.c
error: Failed to merge in the changes.
Patch failed at 0001 Fixes Trac ticket https://trac.ffmpeg.org/ticket/6949
> do you have a test file perhaps?
Will email you one, but the loop with a function that doesnt advance
is an issue even if the specific file doesnt trigger it in a different
implementation
also probaly a good idea if you contact rcombs as you seemed to work on
the same code
I was looking at teh ticket and saw a link to rcombs patch, looked at
the patch and applied it. I did not realize there where 2 patches
thx
[...]
--=20
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
The day soldiers stop bringing you their problems is the day you have stopp=
ed=20
leading them. They have either lost confidence that you can help or conclud=
ed=20
you do not care. Either case is a failure of leadership. - Colin Powell
--QIrx+3S6pmSJvScj
Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE-----
iF0EABEKAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCZ/2YEgAKCRBhHseHBAsP
q2I+AJ4mHngXpUM4JfTpmbPy72ir+4sd3wCfT9z+NWqBTea5ZfdZAHpCvEVT01w=
=AKSP
-----END PGP SIGNATURE-----
--QIrx+3S6pmSJvScj--
--===============5578092762150430559==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
--===============5578092762150430559==--