From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id D6C27452B5 for ; Mon, 14 Jul 2025 19:21:45 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 5995368EE2B; Mon, 14 Jul 2025 22:21:41 +0300 (EEST) Received: from relay8-d.mail.gandi.net (relay8-d.mail.gandi.net [217.70.183.201]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id DA79568EDF4 for ; Mon, 14 Jul 2025 22:21:34 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 46F8B444BF for ; Mon, 14 Jul 2025 19:21:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1752520894; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=1l+z2o3eL94NDMfBd5WzT0Lcs3pkF+cGKHqGcKwD79Q=; b=gyDXmsjzTBp7kkXfBdi0b0U8CSwEXN7/S4WNgOb0bf61JVxkWMDF6lI8esCQnUyA3Jjdjg FwZ0x+fbpjdbiWjURa7pf7MF3BtKJ/DGMfY/KEyJGXWe94h12CbZfrJeGMskN2q28487MX oXtR9FNQ9Gr9TodQuVhQaR3OJgl+adY4d+8yLt4dk1D6IuTwAZ8sAbnq4m5TbELM/wN9C1 Wikh1JwR/3TOANXQ6tiwh6IZVhg1y9QZOk7l+nVa09iMaS0FwuNWq8VsDBfJJwt8+N9DzM LAXraxETJTO+W7xOSSGLCNddFHFWjeZyT5c8pg66tMOF/e1UrMDzK1LIGwu/zQ== Date: Mon, 14 Jul 2025 21:21:33 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20250714192133.GL29660@pb2> References: <20250713011030.1156550-1-michael@niedermayer.cc> MIME-Version: 1.0 In-Reply-To: X-GND-State: clean X-GND-Score: -85 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtdefgdehvdejjecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfitefpfffkpdcuggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucesvcftvggtihhpihgvnhhtshculddquddttddmnegfrhhlucfvnfffucdludehmdenucfjughrpeffhffvuffkfhggtggujgesghdtreertddtvdenucfhrhhomhepofhitghhrggvlhcupfhivgguvghrmhgrhigvrhcuoehmihgthhgrvghlsehnihgvuggvrhhmrgihvghrrdgttgeqnecuggftrfgrthhtvghrnheptefggedvffeiueffvefhiedtgfefjedukeefgeetgeevgeejgeekvdevjeelveeknecuffhomhgrihhnpehgihhthhhusgdrtghomhenucfkphepgedurdeiiedrieehrddujeeinecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepgedurdeiiedrieehrddujeeipdhhvghloheplhhotggrlhhhohhsthdpmhgrihhlfhhrohhmpehmihgthhgrvghlsehnihgvuggvrhhmrgihvghrrdgttgdpnhgspghrtghpthhtohepuddprhgtphhtthhopehffhhmphgvghdquggvvhgvlhesfhhfmhhpvghgrdhorhhg X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [PATCH 1/5] avformat/flvdec: Check for EOF in AudioPacketTypeMultichannelConfig X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============1826370778219164378==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============1826370778219164378== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="XumT53bRY+Jb35C2" Content-Disposition: inline --XumT53bRY+Jb35C2 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Jul 13, 2025 at 01:42:28PM +0200, Timo Rothenpieler wrote: > On 7/13/2025 3:10 AM, Michael Niedermayer wrote: > > Fixes: Infinite loop > > Fixes: 427538726/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-6= 582567304495104 > >=20 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz= /tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer > > --- > > libavformat/flvdec.c | 3 +++ > > 1 file changed, 3 insertions(+) > >=20 > > diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c > > index ac681954cb7..a4fa0157512 100644 > > --- a/libavformat/flvdec.c > > +++ b/libavformat/flvdec.c > > @@ -1715,6 +1715,9 @@ retry_duration: > > av_log(s, AV_LOG_DEBUG, "Set channel data from MultiC= hannel info.\n"); > > + if (avio_feof(s->pb)) > > + return AVERROR_EOF; > > + > > goto next_track; > > } > > } else if (stream_type =3D=3D FLV_STREAM_TYPE_VIDEO) { >=20 > I don't think just returning from here is correct. > The goto next_track right after it already checks for EOF. > I do not see how between here and the eof check there there'd be any way = to > infinite loop. avio_skip() with a negative value will reset the EOF flag >=20 > It returns FFERROR_REDO there, which is important to drain queued up > packages. I think the state becomes corrupted once it reads into EOF that is the size accounting goes "oops" as the code keeps running things that read and keeps accounting for these reads but in reality nothing is read as its at EOF and then it seeks back all these "not reads" and thats where it hits the infinite loop as theres a mismatch what the code thinks it moved forward and what it actually moved forward. Thats how it looked to me at least, i have not verified every step of this ill mail you the testcase, then you can check if my analysis is right and fix the code in a way that can recover queued packets in such truncated packet at EOF case. Also please make sure its not forgotten that whatever fix this gets is back= ported thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Give a rich man 100$ and he will turn it into 1000$. Give a poor man 1000$ and he will spend it. --XumT53bRY+Jb35C2 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEKAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCaHVYugAKCRBhHseHBAsP q22oAJ0e9ER+orOe1SwdNLMA72HyJ1fCqQCfQCQ/n6YKbdbU2D9E2GyL+UY4r/c= =qSCp -----END PGP SIGNATURE----- --XumT53bRY+Jb35C2-- --===============1826370778219164378== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============1826370778219164378==--