From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 9FB574B9E8 for ; Mon, 8 Jul 2024 17:55:34 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id E69F968DCA4; Mon, 8 Jul 2024 20:55:32 +0300 (EEST) Received: from mail-pf1-f175.google.com (mail-pf1-f175.google.com [209.85.210.175]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id AB7E268DC72 for ; Mon, 8 Jul 2024 20:55:25 +0300 (EEST) Received: by mail-pf1-f175.google.com with SMTP id d2e1a72fcca58-70b12572bd8so1753009b3a.2 for ; Mon, 08 Jul 2024 10:55:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1720461322; x=1721066122; darn=ffmpeg.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:to:subject:user-agent:mime-version:date:message-id:from :to:cc:subject:date:message-id:reply-to; bh=yfWFK+3rzHICwlwonLJxZ1oZ7m9X5p2460WaQEwKrCE=; b=eKqb3Vx6SEBiH6NqSWDvttME/tBRcmjtXDiMGsIJg5tu3k249nvyHU81peiCua8GoV MXYCwpaOWAW5iytw/XXlUVvUU4ja2YxG4rhjOrB8aF1C6OVEMt+IM/wJm2aaA61FjE28 j0R1AxEihNcPkFUGYQeihkTndl+lkBdMncpnghkk7qYOjl9xVyyFDq5WkIZZ24HrPCDp 9IWsE1rODInisGDILg1zyr823W5ZxBJOBTjKGi8QL59IqfVeVoyoeFFt/3GwEaEZE2AU evjWACUCU7qB98u9dvgwR7C5/aUT3m6DiwO5c1yjuR4cFIJnQEqX7xTf7CWp4WiG/SfM ebRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720461322; x=1721066122; h=content-transfer-encoding:in-reply-to:from:content-language :references:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=yfWFK+3rzHICwlwonLJxZ1oZ7m9X5p2460WaQEwKrCE=; b=LaLjNa4Z8Es0vlX62ypyY8gm9LIuYS73eQ6iyXLBRlOPIYZN9DzZy/ZFZul4vxTq1M uFlAO/91F5BnvnPmDvsT02fRD3scekWAQQuHFZfdSEYB6ZUJpMYFaFkMzRs6aY6wh1pW G4khB0LWzLnFLWSguZubJp/lhxG183lwXf76ZotYr6/0D4gYvjeG0janRyPU/cM63/m5 Gl8HKq93mLdPlQsLgEkbwGiAcot2d3k8pfIoYIUToIOYxElXe5rCqgbcmsxxKjziP36R Bjn6qYnKjNO9R3krnjS9BStMJfyv0oXLL8LMgnwiDsGz05Ju54On1R6WarjrhLWEpgCN joSg== X-Gm-Message-State: AOJu0Yxz6cr7Iy8KYEUwy9v+W9uZ71iKmmrnPXMCYwNxKBcc/vjoKP8l WNCt3rXrjDfBe9YYZQA+D4aVXcMslzK6Wr8j07UjEG9jsKypxF8o3OcEBQ== X-Google-Smtp-Source: AGHT+IEW6tbOOA1VwmgfHriPsMfI/LErC44Jx1jL11qmBOu069ve6hYMQTaZR599iz9MaY2COrbOJg== X-Received: by 2002:a05:6a21:c98:b0:1c2:93eb:c178 with SMTP id adf61e73a8af0-1c2984ddc0bmr91891637.51.1720461321936; Mon, 08 Jul 2024 10:55:21 -0700 (PDT) Received: from [192.168.0.16] ([190.194.167.233]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-2c99657f1c0sm4939511a91.0.2024.07.08.10.55.20 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 08 Jul 2024 10:55:21 -0700 (PDT) Message-ID: <49cca58a-f8a9-4889-af81-d428e91d0ba8@gmail.com> Date: Mon, 8 Jul 2024 14:55:22 -0300 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: ffmpeg-devel@ffmpeg.org References: Content-Language: en-US From: James Almer In-Reply-To: Subject: Re: [FFmpeg-devel] [PATCH 2/2] avformat/matroskaenc: Fix and simplify check for invalid crop values X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: On 7/8/2024 2:24 PM, Andreas Rheinhardt wrote: > The check "left >= INT_MAX - right" is supposed to check for > whether left + right does not overflow/wraparound, but given that > left and top are uint32_t INT_MAX - right can already wraparound > for big values of right (and ordinary 32-bit ints): > If right == UINT32_MAX, INT_MAX - right is INT_MAX + 1; > for left in 0..par->width both checks will be passed. > > Fix this and simplify the check by using 64-bit types, > where the addition is guaranteed not to overflow. > > Signed-off-by: Andreas Rheinhardt > --- > libavformat/matroskaenc.c | 6 ++---- > 1 file changed, 2 insertions(+), 4 deletions(-) > > diff --git a/libavformat/matroskaenc.c b/libavformat/matroskaenc.c > index e1adc0eba6..4b91283119 100644 > --- a/libavformat/matroskaenc.c > +++ b/libavformat/matroskaenc.c > @@ -1786,16 +1786,14 @@ static int mkv_write_track_video(AVFormatContext *s, MatroskaMuxContext *mkv, > st->codecpar->nb_coded_side_data, > AV_PKT_DATA_FRAME_CROPPING); > if (sd && sd->size == sizeof(uint32_t) * 4) { > - uint32_t top, bottom, left, right; > + uint64_t top, bottom, left, right; > > top = AV_RL32(sd->data + 0); > bottom = AV_RL32(sd->data + 4); > left = AV_RL32(sd->data + 8); > right = AV_RL32(sd->data + 12); > > - if (left >= INT_MAX - right || > - top >= INT_MAX - bottom || > - (left + right) >= par->width || > + if ((left + right) >= par->width || > (top + bottom) >= par->height) { > av_log(s, AV_LOG_ERROR, "Invalid cropping dimensions in stream side data\n"); > return AVERROR(EINVAL); LGTM. _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".