From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 5E2D041069 for ; Sat, 14 May 2022 20:55:48 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id F244968B482; Sat, 14 May 2022 23:55:35 +0300 (EEST) Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id C877668B455 for ; Sat, 14 May 2022 23:55:26 +0300 (EEST) Received: by mail-pg1-f169.google.com with SMTP id q76so10588381pgq.10 for ; Sat, 14 May 2022 13:55:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:message-id:in-reply-to:references:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=Xarnv5vIwXMy5lH5rxP7K+aIHzBAnNq8DgFofdT+WwQ=; b=D3QJq1RljI/R8uVUs5cnlmlaoHM9uS2gbT7gFTBhMkkLo+bSKikGscneluntLuwDAg YDZbv8hAlB5kdSReYdFHZ51wrIFrtQklFp6lXi0xcl+xUjZxF6IH5ZGj9QL9i6aP+RwG 2mFsHBHG8o6adLsNy4Ih2sAbUYRyxrPYE15L0lqHBq+bisBgk4LBYIfkTrVCSFW3Mx8I ElVN9jovxwHTB+qrwE9hCtCek0n5MEX21Tp2bt55fFYef8u1Rjh3k/sbd8Z97tEwtzxt MpyDH5iveeJh6V1bCp/3C9xuzP2rmX0susOHesZy5JlrjT1+gHkxeVpUnugom+AxxJhJ ETvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:message-id:in-reply-to:references:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=Xarnv5vIwXMy5lH5rxP7K+aIHzBAnNq8DgFofdT+WwQ=; b=coBxBQSumk5CzUlJj4roozOEdZrqScHhrRvQOODwy1QIqqFL0B7XGDebpN/A9l1j5W CsbSRlfx81n/uzH2KHT6kTBKf1d+tVfuzt/Ylm4Y5AKFXxRgSXA4HI58ZsS0aCquGfzq sQbT5v6M8ylp851TcsdVF9I6tk5NTLyx6kHujbxZ/FoADNROpr6QHxNicgZVRJ1QyBVC Q+Bx+oOud71+RpSd0xMFIZTq6Si0gw5VMXR6y/Iyb10vjs9otw/Mem1MB5IXYmgr1snK GXftB2OPOrZzg9+H0KbSJ6vsPXlCSq3M0nFcKUnTU/gHwrg10dbeCEoHsAlRdazbOOn7 /iXg== X-Gm-Message-State: AOAM530wkGfalCeDEUW4eLgj9VZDkHXzojS5Ta85aC7RY4kW2ECh2h/4 PXVaY0ek/8NdkyDTVzV8gjQcdUcMJ0TdyQ== X-Google-Smtp-Source: ABdhPJy80bmLoO7+Uiyuz9AHwt01c3pYFZhjwNRBz7PWVMIOHosKyfsYp0//9NAQVgH6Dh86ICdVGw== X-Received: by 2002:a65:6e44:0:b0:3db:219e:2250 with SMTP id be4-20020a656e44000000b003db219e2250mr9231600pgb.369.1652561725231; Sat, 14 May 2022 13:55:25 -0700 (PDT) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id a29-20020a62d41d000000b0050dc7628160sm4034711pfh.58.2022.05.14.13.55.24 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 14 May 2022 13:55:24 -0700 (PDT) From: softworkz X-Google-Original-From: softworkz Message-Id: <60966b79077e80d51c6ec77c3543e89dc148aed0.1652561722.git.ffmpegagent@gmail.com> In-Reply-To: References: Date: Sat, 14 May 2022 20:55:13 +0000 Fcc: Sent MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Subject: [FFmpeg-devel] [PATCH v4 01/10] libavformat/asf: fix handling of byte array length values X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Michael Niedermayer , softworkz Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: From: softworkz The spec allows attachment sizes of up to UINT32_MAX while we can handle only sizes up to INT32_MAX (in downstream code) The debug.assert in get_tag didn't really address this, and truncating the value_len in calling methods cannot be used because the length value is required in order to continue parsing. This adds a check with log message in ff_asf_handle_byte_array to handle those (rare) cases. Signed-off-by: softworkz --- libavformat/asf.c | 8 +++++++- libavformat/asf.h | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/libavformat/asf.c b/libavformat/asf.c index 1285062220..bec7db0c7e 100644 --- a/libavformat/asf.c +++ b/libavformat/asf.c @@ -139,12 +139,18 @@ static int get_id3_tag(AVFormatContext *s, int len) } int ff_asf_handle_byte_array(AVFormatContext *s, const char *name, - int val_len) + uint32_t val_len) { + if (val_len > INT32_MAX) { + av_log(s, AV_LOG_VERBOSE, "Unable to handle byte arrays > INT32_MAX in tag %s.\n", name); + return 1; + } + if (!strcmp(name, "WM/Picture")) // handle cover art return asf_read_picture(s, val_len); else if (!strcmp(name, "ID3")) // handle ID3 tag return get_id3_tag(s, val_len); + av_log(s, AV_LOG_DEBUG, "Unsupported byte array in tag %s.\n", name); return 1; } diff --git a/libavformat/asf.h b/libavformat/asf.h index 01cc4f7a46..4d28560f56 100644 --- a/libavformat/asf.h +++ b/libavformat/asf.h @@ -111,7 +111,7 @@ extern const AVMetadataConv ff_asf_metadata_conv[]; * is unsupported by this function and 0 otherwise. */ int ff_asf_handle_byte_array(AVFormatContext *s, const char *name, - int val_len); + uint32_t val_len); #define ASF_PACKET_FLAG_ERROR_CORRECTION_PRESENT 0x80 //1000 0000 -- ffmpeg-codebot _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".