From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 9512E4A19D for ; Mon, 22 Apr 2024 20:40:17 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id C1CF868D385; Mon, 22 Apr 2024 23:40:14 +0300 (EEST) Received: from mail-wr1-f48.google.com (mail-wr1-f48.google.com [209.85.221.48]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 6CFE468D2CE for ; Mon, 22 Apr 2024 23:40:08 +0300 (EEST) Received: by mail-wr1-f48.google.com with SMTP id ffacd0b85a97d-343f62d8124so3928282f8f.2 for ; Mon, 22 Apr 2024 13:40:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jkqxz-net.20230601.gappssmtp.com; s=20230601; t=1713818408; x=1714423208; darn=ffmpeg.org; h=content-transfer-encoding:in-reply-to:from:references:to :content-language:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=9R+1CIWPZ1nyZLsLeMmjR2G2ijspXXO75OfKCwW1Plc=; b=md5IJO/LxOad4QeXXXgHtD9UL4WNhszwUeHo19yh6pIDoCqH2p0Nwf5Z6wB8g0vLkE Q8Nnnzt21yhZx2hAWNSoBNg03VRCbE8OKCy6rXTxw6MF9uwvWS6kwHHk/ZEiU9Jz2DDp 8AB/AC8+EY9bIPcCQf7WjAtwR99F99KqBcrOPAWQoeC+eP0P01LKTxxJ/c9M4T2h1NNE cVR7njNLGZarlqdmaUJY4YTZss0HlaQzFBK36fH4Gr4yYH79wjUWkop3dkWRLJGsEGwZ WCNOlKGL0bSXXgDM34TxQA9b6/SLqwIj851pZxyHSxpwdIvXdfF7oA+qCA+p0U0642XL O8TQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713818408; x=1714423208; h=content-transfer-encoding:in-reply-to:from:references:to :content-language:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=9R+1CIWPZ1nyZLsLeMmjR2G2ijspXXO75OfKCwW1Plc=; b=a/MEV16g3xMxxFsr8HUGR5+mnubHAHCJwCoqkcI1GH7h1Pa95hOMt+XKT2+sbUsDgZ wrr796yOkI8AtA2WiTxJwxGVv6ohmgWMKP4y8ZZlgFVThiukRQrJeWzuGO7aQ15zVTLu SgsuBVMs2JBFswE31w+39wzQXebUoR4JmcPM/ElBlA5WI1sOstb7f7sRSsAsUxeDXi+6 zhgyqPmes8hP3/VPy7tXsmR53AlrmasK8UJsMtvT2gR32kjQJsXhOZl9Otl18G5A5wDg Sz1kATXQShrI733rAuUVS4t7rEh0yfo4O9LYBbjyFj5BLcrVeznmYe9pkVLfzbEj/7dD PrXw== X-Gm-Message-State: AOJu0YwURGiuoxgr7Mm8Vh+sjYeIs7qalDPr8mhXtFjJO6VKB5gE8RR+ Urt5TdOJXpj60ZwX/PFe/hm3G0nAWczCqbKA/QSnngk99t8KUCIamu/rc9NGcpJOW6Q145cz9qQ n X-Google-Smtp-Source: AGHT+IE1e5/A6wrqh1m1anchyk4Yc6QtGbemGQZcg0UB6UqxO7Jpv0F2xEcHYNxuSiRF9qt8J5llHw== X-Received: by 2002:adf:ee03:0:b0:343:8373:1591 with SMTP id y3-20020adfee03000000b0034383731591mr6149234wrn.64.1713818407707; Mon, 22 Apr 2024 13:40:07 -0700 (PDT) Received: from [192.168.0.15] (cpc92302-cmbg19-2-0-cust1183.5-4.cable.virginm.net. [82.1.212.160]) by smtp.gmail.com with ESMTPSA id r30-20020adfb1de000000b00343e392829dsm13024714wra.97.2024.04.22.13.40.07 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 22 Apr 2024 13:40:07 -0700 (PDT) Message-ID: <67b2f0ee-9465-4b76-ad15-be68d9faa987@jkqxz.net> Date: Mon, 22 Apr 2024 21:40:31 +0100 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: ffmpeg-devel@ffmpeg.org References: <20240422013150.458103-1-michael@niedermayer.cc> From: Mark Thompson In-Reply-To: <20240422013150.458103-1-michael@niedermayer.cc> Subject: Re: [FFmpeg-devel] [PATCH] avcodec/cbs_h2645: Check NAL space X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: On 22/04/2024 02:31, Michael Niedermayer wrote: > Found-by-reviewing: CID1419833 Untrusted loop bound > > Sponsored-by: Sovereign Tech Fund > Signed-off-by: Michael Niedermayer > --- > libavcodec/cbs_h2645.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c > index fe2e383ff33..1a45d424bae 100644 > --- a/libavcodec/cbs_h2645.c > +++ b/libavcodec/cbs_h2645.c > @@ -709,7 +709,11 @@ static int cbs_h2645_split_fragment(CodedBitstreamContext *ctx, > > start = bytestream2_tell(&gbc); > for(i = 0; i < num_nalus; i++) { > + if (bytestream2_get_bytes_left(&gbc) < 2) > + return AVERROR_INVALIDDATA; > size = bytestream2_get_be16(&gbc); > + if (bytestream2_get_bytes_left(&gbc) < size) > + return AVERROR_INVALIDDATA; > bytestream2_skip(&gbc, size); > } > end = bytestream2_tell(&gbc); Seems fair. The problem looks more general with missing bounds checks in all the H.266 code around this, though? Compare with H.26[45], which have checks on all the reads - seems like H.266 should be doing that. Thanks, - Mark _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".