From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id A14314C981 for ; Wed, 6 Aug 2025 22:05:37 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 5460A68CBD2; Thu, 7 Aug 2025 01:05:33 +0300 (EEST) Received: from relay7-d.mail.gandi.net (relay7-d.mail.gandi.net [217.70.183.200]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 5ACCF68C6AA for ; Thu, 7 Aug 2025 01:05:26 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 99EFF43178 for ; Wed, 6 Aug 2025 22:05:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1754517925; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=IbFTLAthwG0+Gdb2g+VcuewsGWJZHIcyWHFYPIGdZ8E=; b=HWnSmP6TMSmZ4HxiwlMJRi5vnGAvgH59uxi8PsYS/9Z3WrwgsbXj6TOsCv23PvXEhZsUnJ /Zbk7BHS92SAIkgzk+75RCAaNk170QehCtUSacpmJqRdHG1dRfaeMv6GpI+uPtYX3QZKw1 eFniHIcThvTJ5vjVtKZ45S2NU7467EEK9O790P5xS0J/19UOUHYt21IFFin8lJeVev/mR3 67TY2hJJWwR5xDiNNxhygmWSbXgkrn1swMXN2E3gmpLK4IfvQXcjRbRgPOf6Xa4oy2moQe HkbjNK9d54G6HCTPlwd1vxdZXp07UGH5tyxmYBBbcrlnVuYdKKFwx4BIy6Lh6Q== Date: Thu, 7 Aug 2025 00:05:24 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20250806220524.GY29660@pb2> References: MIME-Version: 1.0 In-Reply-To: X-GND-State: clean X-GND-Score: -85 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtdefgdduudelvddtucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuifetpfffkfdpucggtfgfnhhsuhgsshgtrhhisggvnecuuegrihhlohhuthemuceftddunecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenfghrlhcuvffnffculdduhedmnecujfgurhepfffhvffukfhfgggtuggjsehgtderredttddvnecuhfhrohhmpefoihgthhgrvghlucfpihgvuggvrhhmrgihvghruceomhhitghhrggvlhesnhhivgguvghrmhgrhigvrhdrtggtqeenucggtffrrghtthgvrhhnpeeigeektdejudffjefhteegjedtgeettefggedthfejgfevhfetgeekjedtvdfhveenucfkphepgedurdeiiedrieehrddujeeinecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepgedurdeiiedrieehrddujeeipdhhvghloheplhhotggrlhhhohhsthdpmhgrihhlfhhrohhmpehmihgthhgrvghlsehnihgvuggvrhhmrgihvghrrdgttgdpnhgspghrtghpthhtohepuddprhgtphhtthhopehffhhmphgvghdquggvvhgvlhesfhhfmhhpvghgrdhorhhg X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [h264] Make ff_h264_build_ref_list stricter with AV_EF_EXPLODE X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============1179229944118364907==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============1179229944118364907== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="IWvRQ1nKU3lnap+T" Content-Disposition: inline --IWvRQ1nKU3lnap+T Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi On Tue, Aug 05, 2025 at 02:52:28PM -0700, Dale Curtis wrote: > Don't silently skip errors when AV_EF_EXPLODE is specified. This can > lead to out-of-bound reads with ff_put_h264_chroma_mc4_ssse3() when > small padding is used with the checked bitstream reader. >=20 > Signed-off-by: Dale Curtis > h264_refs.c | 7 +++++++ > 1 file changed, 7 insertions(+) > e453856d1d24c3a4c2e42d61acdeff3b09b226da h264_stricter_v1.patch > From 46b2fa1ec0cbd00c4fd3909665608d79760654d0 Mon Sep 17 00:00:00 2001 > From: Dale Curtis > Date: Tue, 5 Aug 2025 21:45:19 +0000 > Subject: [PATCH] Make ff_h264_build_ref_list stricter with AV_EF_EXPLODE >=20 > Don't silently skip errors when AV_EF_EXPLODE is specified. ok > This can > lead to out-of-bound reads with ff_put_h264_chroma_mc4_ssse3() when > small padding is used with the checked bitstream reader. this sounds a bit fishy >=20 > Signed-off-by: Dale Curtis > --- > libavcodec/h264_refs.c | 7 +++++++ > 1 file changed, 7 insertions(+) >=20 > diff --git a/libavcodec/h264_refs.c b/libavcodec/h264_refs.c > index 74840e5909..e6e3adf502 100644 > --- a/libavcodec/h264_refs.c > +++ b/libavcodec/h264_refs.c > @@ -370,6 +370,9 @@ int ff_h264_build_ref_list(H264Context *h, H264SliceC= ontext *sl) > i < 0 ? "reference picture missing during reorder= \n" : > "mismatching reference\n" > ); > + if (h->avctx->err_recognition & AV_EF_EXPLODE) { > + return AVERROR_INVALIDDATA; > + } indention depth is 4 in ffmpeg consistently > memset(&sl->ref_list[list][index], 0, sizeof(sl->ref_lis= t[0][0])); // FIXME > } else { > for (i =3D index; i + 1 < sl->ref_count[list]; i++) { > @@ -392,6 +395,10 @@ int ff_h264_build_ref_list(H264Context *h, H264Slice= Context *sl) > for (int index =3D 0; index < sl->ref_count[list]; index++) { > if ( !sl->ref_list[list][index].parent > || (!FIELD_PICTURE(h) && (sl->ref_list[list][index].refe= rence&3) !=3D 3)) { > + if (h->avctx->err_recognition & AV_EF_EXPLODE) { > + av_log(h->avctx, AV_LOG_ERROR, "Missing reference pict= ure\n"); > + return AVERROR_INVALIDDATA; > + } > av_log(h->avctx, AV_LOG_ERROR, "Missing reference pictur= e, default is %d\n", h->default_ref[list].poc); the error out can be after this av_log() avoiding the 2nd av_log() in the i= f() thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB I am the wisest man alive, for I know one thing, and that is that I know nothing. -- Socrates --IWvRQ1nKU3lnap+T Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEKAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCaJPRoQAKCRBhHseHBAsP qzZQAJ92QtOMUbBLBpoXSbbs/chLa/J4IACgnAuachdVzzhL9A+qbcfivClJfY8= =DH+Q -----END PGP SIGNATURE----- --IWvRQ1nKU3lnap+T-- --===============1179229944118364907== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============1179229944118364907==--