From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) by master.gitmailbox.com (Postfix) with ESMTPS id 4BD47406C5 for ; Wed, 22 Dec 2021 15:13:55 +0000 (UTC) Received: by mail-pj1-f45.google.com with SMTP id f18-20020a17090aa79200b001ad9cb23022so2892460pjq.4 for ; Wed, 22 Dec 2021 07:13:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=BKnvysC4+77ghBfg4JJQEc87JTh1i8ZYjV9d/pAd33w=; b=lj20Bje05nctnbhlgwmoIO4uLfQFE8RkX9xFPbQ0npvl03vRe/+UC+De0o7ykmHK61 DnbJEYNtHdJQgiIyLYmNpBfTMuRarydoDrvfk2tpQ/ewy6BzFZHup1ut+EyyxX8WljJV WhwqOkNmhIKuEWNg8G+CvNJdRHNak9A+fQLOP//7lqBX57RVG0/iybpX/sATR5kATgP8 SVTN/1bWl6k1S14kSOyjKdVP5sjzeVHWOVpD3+mq/ldVQkExNcCu6l2EUufnT0wwbSYK xhbQF9DIQNsEK42vjaRKzfBBfG/H3udar1pPe4afCeWSvWSdDMTgSBBGu+2mgxsGO5Z7 D56g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=BKnvysC4+77ghBfg4JJQEc87JTh1i8ZYjV9d/pAd33w=; b=aph7YPcFGIXq0atBe6Y6YdYoaZTxseTHDVDqTX9IKTGtDPDn7M/CY//sSJ8CNZd0mb XuRgXn4csfESXM3i7lu8AWBhVmOQTmWFl4xrv6CAZcOC4CCLrcKDtdeBqxgWIXaEq6mB 8AKeFs2CMMtQ7273hjxg7KKs0cVmDlSpkXHVxS1baD7PB+jRM/WeoDhvGyRSH8ToPBZc NLjpmjn6bOzb2oRYMfHlHF3SnMkWhmDJCDC9YZpl5N4fhWnz+ic8JoYauUad0Rp3EB2K 1tuFaK1CmVpHUMUGN6r47icpnAudTyCqbpIi72oJ+mxF25y7kXIkkidvVdJFdSTF0KYA NM0g== X-Gm-Message-State: AOAM533HSpNss/ryoKJHBjektble2SEE2V/qQSprZyDC8c7mzqgtMWK4 Z376UhN63CfFk/6Pq/zD8mTtHhthUQ4cGVlb X-Google-Smtp-Source: ABdhPJw6fIjP1xsS36GB1n7B3/FE5RNB/DBaHCVnpNSDC/AbK33569jdO16RrKHfjkK1wMRGCtOAyA== X-Received: by 2002:a17:90a:520e:: with SMTP id v14mr1782584pjh.221.1640186035056; Wed, 22 Dec 2021 07:13:55 -0800 (PST) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id f14sm3061002pfv.215.2021.12.22.07.13.54 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Dec 2021 07:13:54 -0800 (PST) Message-Id: <3528d4688633d1e42f2999d3f3615d2054f2b807.1640186030.git.ffmpegagent@gmail.com> In-Reply-To: References: From: ffmpegagent Date: Wed, 22 Dec 2021 15:13:43 +0000 Subject: [PATCH 04/11] libavformat/asfdec: fixing get_tag Fcc: Sent Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit MIME-Version: 1.0 To: ffmpegdev@gitmailbox.com Cc: softworkz , softworkz Archived-At: List-Archive: List-Post: From: softworkz These three are closely related and can't be separated easily: In get_tag, the code was adding 22 bytes (in order to allow it to hold 64bit numbers as string) to the value len for creating creating a buffer. This was unnecessarily imposing a size-constraint on the value_len parameter. The code in get_tag, was limiting the maximum value_len to half the size of INT32. This was applied for all value types, even though it is required only in case of ASF_UNICODE, not for any other ones (like ASCII). get_tag was always allocating a buffer regardless of the datatype, even though this isn't required in case of ASF_BYTE_ARRAY The check for the return value from ff_asf_handle_byte_array() being >0 is removed here because the log message is emitted by the function itself now. Signed-off-by: softworkz --- libavformat/asfdec_f.c | 54 +++++++++++++++++++++++++++++++----------- 1 file changed, 40 insertions(+), 14 deletions(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index 29b429fee9..58c424b565 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -221,37 +221,63 @@ static uint64_t get_value(AVIOContext *pb, int type, int type2_size) static void get_tag(AVFormatContext *s, const char *key, int type, uint32_t len, int type2_size) { ASFContext *asf = s->priv_data; - char *value = NULL; int64_t off = avio_tell(s->pb); -#define LEN 22 - - av_assert0((unsigned)len < (INT_MAX - LEN) / 2); + char *value = NULL; + uint64_t required_bufferlen; + int buffer_len; if (!asf->export_xmp && !strncmp(key, "xmp", 3)) goto finish; - value = av_malloc(2 * len + LEN); + switch (type) { + case ASF_UNICODE: + required_bufferlen = (uint64_t)len * 2 + 1; + break; + case -1: // ASCII + required_bufferlen = (uint64_t)len + 1; + break; + case ASF_BYTE_ARRAY: + ff_asf_handle_byte_array(s, key, len); + goto finish; + case ASF_BOOL: + case ASF_DWORD: + case ASF_QWORD: + case ASF_WORD: + required_bufferlen = 22; + break; + case ASF_GUID: + required_bufferlen = 33; + break; + default: + required_bufferlen = len; + break; + } + + if (required_bufferlen > INT32_MAX) { + av_log(s, AV_LOG_VERBOSE, "Unable to handle values > INT32_MAX in tag %s.\n", key); + goto finish; + } + + buffer_len = (int)required_bufferlen; + + value = av_malloc(buffer_len); if (!value) goto finish; switch (type) { case ASF_UNICODE: - avio_get_str16le(s->pb, len, value, 2 * len + 1); + avio_get_str16le(s->pb, len, value, buffer_len); break; - case -1: // ASCI - avio_read(s->pb, value, len); - value[len]=0; + case -1: // ASCII + avio_read(s->pb, value, buffer_len - 1); + value[buffer_len - 1] = 0; break; - case ASF_BYTE_ARRAY: - if (ff_asf_handle_byte_array(s, key, len) > 0) - av_log(s, AV_LOG_VERBOSE, "Unsupported byte array in tag %s.\n", key); - goto finish; case ASF_BOOL: case ASF_DWORD: case ASF_QWORD: case ASF_WORD: { uint64_t num = get_value(s->pb, type, type2_size); - snprintf(value, LEN, "%"PRIu64, num); + snprintf(value, buffer_len, "%"PRIu64, num); break; } case ASF_GUID: -- gitgitgadget