From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id CFD0E45E94 for ; Mon, 14 Jul 2025 22:01:53 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 355C468D491; Tue, 15 Jul 2025 01:01:49 +0300 (EEST) Received: from relay1-d.mail.gandi.net (relay1-d.mail.gandi.net [217.70.183.193]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 021C768D491 for ; Tue, 15 Jul 2025 01:01:41 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 19C22432F7 for ; Mon, 14 Jul 2025 22:01:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1752530501; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=H0Ga8NZJJg4+sN68ZyoVJicWGFW8FRLz85xNFj+xmwQ=; b=ROJ1CM8d9K7ZebiehKe4evj+knt/xX9RrmBtryJmo07vZTOkKVUSnNaoPk6THyJwiIj6gT 1znuqPVaMouRY6a6vR0AzutUwzHIZX02zd8OlVG3d+dAJgmM80Al1150EsyEhrIt1qjMOW VOflz39zMAfIk9gBHxCH9gh5mGc29YTOAX6LONpbprRmlTil0fleplydBZ8rKxVpmtOZqh 8NVapeJcSMt4A7/XCW44LwJJyk0XDDe3qiQfSCm5ppS7VxwBFLHcY7pbrWiIeOZz1eVrLj 298PBhByl4kRaFdhRkMo9tYKsRbUKujw8nwqE+Vb1omFDvrWaVLh1OLBlynzqw== Date: Tue, 15 Jul 2025 00:01:40 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20250714220140.GP29660@pb2> References: <20250713011030.1156550-1-michael@niedermayer.cc> <20250714192133.GL29660@pb2> <71ce56e6-5d83-41f7-9872-e81e0a342cf9@rothenpieler.org> MIME-Version: 1.0 In-Reply-To: <71ce56e6-5d83-41f7-9872-e81e0a342cf9@rothenpieler.org> X-GND-State: clean X-GND-Score: -90 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtdefgdehfedutdcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfitefpfffkpdcuggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucesvcftvggtihhpihgvnhhtshculddquddttddmnegfrhhlucfvnfffucdluddtmdenucfjughrpeffhffvuffkfhggtggujgesghdtreertddtvdenucfhrhhomhepofhitghhrggvlhcupfhivgguvghrmhgrhigvrhcuoehmihgthhgrvghlsehnihgvuggvrhhmrgihvghrrdgttgeqnecuggftrfgrthhtvghrnheptefggedvffeiueffvefhiedtgfefjedukeefgeetgeevgeejgeekvdevjeelveeknecuffhomhgrihhnpehgihhthhhusgdrtghomhenucfkphepgedurdeiiedrieehrddujeeinecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepgedurdeiiedrieehrddujeeipdhhvghloheplhhotggrlhhhohhsthdpmhgrihhlfhhrohhmpehmihgthhgrvghlsehnihgvuggvrhhmrgihvghrrdgttgdpnhgspghrtghpthhtohepuddprhgtphhtthhopehffhhmphgvghdquggvvhgvlhesfhhfmhhpvghgrdhorhhg X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [PATCH 1/5] avformat/flvdec: Check for EOF in AudioPacketTypeMultichannelConfig X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============6560710341142100823==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============6560710341142100823== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="61stsypP0O+0U3y9" Content-Disposition: inline --61stsypP0O+0U3y9 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Jul 14, 2025 at 10:00:19PM +0200, Timo Rothenpieler wrote: > On 7/14/2025 9:21 PM, Michael Niedermayer wrote: > > On Sun, Jul 13, 2025 at 01:42:28PM +0200, Timo Rothenpieler wrote: > > > On 7/13/2025 3:10 AM, Michael Niedermayer wrote: > > > > Fixes: Infinite loop > > > > Fixes: 427538726/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzz= er-6582567304495104 > > > >=20 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-= fuzz/tree/master/projects/ffmpeg > > > > Signed-off-by: Michael Niedermayer > > > > --- > > > > libavformat/flvdec.c | 3 +++ > > > > 1 file changed, 3 insertions(+) > > > >=20 > > > > diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c > > > > index ac681954cb7..a4fa0157512 100644 > > > > --- a/libavformat/flvdec.c > > > > +++ b/libavformat/flvdec.c > > > > @@ -1715,6 +1715,9 @@ retry_duration: > > > > av_log(s, AV_LOG_DEBUG, "Set channel data from M= ultiChannel info.\n"); > > > > + if (avio_feof(s->pb)) > > > > + return AVERROR_EOF; > > > > + > > > > goto next_track; > > > > } > > > > } else if (stream_type =3D=3D FLV_STREAM_TYPE_VIDEO) { > > >=20 > > > I don't think just returning from here is correct. > > > The goto next_track right after it already checks for EOF. > >=20 > > > I do not see how between here and the eof check there there'd be any = way to > > > infinite loop. > >=20 > > avio_skip() with a negative value will reset the EOF flag > >=20 > >=20 > > >=20 > > > It returns FFERROR_REDO there, which is important to drain queued up > > > packages. > >=20 > > I think the state becomes corrupted once it reads into EOF > > that is the size accounting goes "oops" as the code keeps running > > things that read and keeps accounting for these reads but in reality > > nothing is read as its at EOF > > and then it seeks back all these "not reads" and thats where it hits the > > infinite loop as theres a mismatch what the code thinks it moved forward > > and what it actually moved forward. > > Thats how it looked to me at least, i have not verified every step of t= his > >=20 > > ill mail you the testcase, then you can check if my analysis is right > > and fix the code in a way that can recover queued packets in such trunc= ated > > packet at EOF case. > > Also please make sure its not forgotten that whatever fix this gets is = backported > I'm unable to reproduce any infinite loops, even with the sample. > But the code there definitely is sub-optimal, given the seek can go the > wrong way, and even when going the right way can potentially reset the EOF > flag. >=20 > Proposed patch is attached. > flvdec.c | 12 ++++++++++-- > 1 file changed, 10 insertions(+), 2 deletions(-) > 681dde0e1e99d4e0cee0f4eec92eb3dc229a25d4 0001-avformat-flvdec-don-t-skip= -backwards-or-at-EOF.patch > From 7ff394e1ecab504a4cb0fda4bd0f25d88ee4f6fe Mon Sep 17 00:00:00 2001 > From: Timo Rothenpieler > Date: Mon, 14 Jul 2025 21:54:35 +0200 > Subject: [PATCH] avformat/flvdec: don't skip backwards or at EOF >=20 > --- > libavformat/flvdec.c | 12 ++++++++++-- > 1 file changed, 10 insertions(+), 2 deletions(-) >=20 > diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c > index b90ed34b1c..de5e688822 100644 > --- a/libavformat/flvdec.c > +++ b/libavformat/flvdec.c > @@ -1860,8 +1860,16 @@ retry_duration: > next_track: > if (track_size) { > av_log(s, AV_LOG_WARNING, "Track size mismatch: %d!\n", trac= k_size); > - avio_skip(s->pb, track_size); > - size -=3D track_size; > + if (!avio_feof(s->pb)) { > + if (track_size > 0) { > + avio_skip(s->pb, track_size); > + size -=3D track_size; > + } else { > + /* We have somehow read more than the track had to o= ffer, leave and re-sync */ > + ret =3D FFERROR_REDO; > + goto leave; > + } > + } > } i think this is not correct if a corrupted packet pushes you 1gb forward into EOF you must seek back and by extension (if that logic is correct) we also can require a seek back without EOF I have not deeply analyzed the flv code today, so i may miss something thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB What does censorship reveal? It reveals fear. -- Julian Assange --61stsypP0O+0U3y9 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEKAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCaHV+QAAKCRBhHseHBAsP q/SmAJ9rcn0UuCITXuRx3z/t5esn7E5W4ACcDMcZRTOEXOp3+cn/SlOejNeCOIY= =40nq -----END PGP SIGNATURE----- --61stsypP0O+0U3y9-- --===============6560710341142100823== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============6560710341142100823==--